[Dovecot] pipe() error but not linked to kqueue

[Patrick Milvich]

I have dovecot 1.0.5 installed on an OpenBSD 4.1 box and an OS X  
Server 10.4.10 box.

Sure you've all heard it before, because of the pipe error, no more  
login processes can be launched, and I have to restart the server.

dovecot: Sep 13 05:50:00 Error: pipe() failed: Too many open files

I first thought this was the issue with kqueue, but I've since  
recompiled making sure to use poll. This also happened with 1.0.3 and  
1.0.2.

It also happens very specifically after a dictionary attack that  
lasts usually about an hour, unless I can catch it earlier. (Around  
18,000 login attempts)
ex:
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login:  
user=<aaron>, method=PLAIN, rip=62.161.41.32, lip=<local ip>
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login: user=<adm>,  
method=PLAIN, rip=62.161.41.32, lip=<local ip>
dovecot: Sep 13 05:49:58 Info: pop3-login: Aborted login:  
user=<account>, method=PLAIN, rip=62.161.41.32, lip=<local ip>

But after the attack has subsided for a period of time, I still have  
the number of file descriptors maxed out for the dovecot process.  
I've increased the number available to have a higher roof, but that  
doesn't fix the problem.

Wondering if anyone else has seen this issue, and also in a generic  
problem. How are others dealing the the problem of being attacked in  
this method? Is there a max number of login tries for a given ip  
address within a period of time that I'm missing? :)

Thanks,
Patrick