If the deferred queue has more than 2000 messages and some of those deferred messages have more than 10 recipients this script emails the email address and and number of deferred messages that have over ten recipients to $1

gistfile1.sh

#!/bin/bash
detect_spammers () {
numq=$(su - zimbra -c "mailq" | wc -l)
if (( $numq > 2000 ));
then
        echo "number of messages deferred: $numq"
        echo "# of messages per user"
        sendmail "$@" \
             < <(echo -en "spammers detected on host:"; hostname; echo "| # deferred | email@address |"; su - zimbra -c "mailq" | tail -n +2 | grep -v '^ *(' \
             | awk 'BEGIN { RS=""; }{ if (NF > 10 ) print $7 }' \
             | tr -d '*!' | sort | uniq -c)
fi
}
detect_spammers support@enovance.com