Hi Junhua, Eric,
looking to the last flow of spams that reach my account, after McColo's "death", I have observed that a big part of them have sender's address like ?[at]?.com.au, where wilcard ? act as usual and represent any character string of any lenghth, but the base domain is constantly ".com.au".Probably is another spam technique.
I don't kow how hard could be to implement a filter with a wildcard mask address, but I think that could eliminate automaticaly a lot of spams before beeing quarantined, which will decease the number of autentification messages sent by CAS, and the whole activity on server.
Pehaps in the future version?....

Brgds