The most effective way to deal with mail bombs is to slow the sender down as much as possible, This will make delivering email to your domain very costly to them in terms of CPU time.
For this you create a mail flow policy like Trottled_Slow_Down
Max. Messages Per Connection: 1
Max. Recipients Per Message: 3-5
Max. Concurrent Connections From a Single IP: 1
under mail flow
Max. Recipients Per Hour: 2
be careful with rate limits for senders and leave them default first.
The rest should match your normal mail flow policy for accepted. The create a HAT matching this mail flow policy and add the corresponding hostnames or IP addresses. You can still create now a basic message filter to drop such messages if needed but you will see some of the bad actors will stop very quickly when they start seeing mail queues at their end.
I hope that helps
-Marc
