block hacked zimbra email accounts

We have a Zimbra server and our users constantly fall into phishing traps and get hacked. We need some expert to provide a fix or a code that detects a email spamming (we can set a trheshold for example if the email sent more than 1000 emails in an hour, block the account) Currently with ZImbra we can only block the IP adress of the offended account, this doesn't work because it blocks the entire organization's email adresses. We just need a script that detects the offending account, blocks it, and then sends us an alert so we can take care of the hacked account