As usually happens, I was investigating one thing, and discovered something else in the process. Long story short, I have spammers attempting to connect to my mail server via port 443, https, which of course is used for OWA, etc. Right at this moment I have about 30 connections that I'm watching...