On 6.6.2012, at 2.08, Glenn English wrote: >> And these brute force attempts would be logged, each one. > > They are, with no rhost. And there are other brute force attempts > that *do* have IPs. I think the answer to this is simply that Dovecot v1.0 didn't tell PAM the rhost. Upgrade.