slow down connections for spammy deliveries, and too many failed authentications, and sleep for 15 seconds before delivering messages by first-time senders

similar to greylisting, but not quite the same: with greylisting you would
always reject the first delivery attempt with a temporary failure. with the
hope that spammers won't retry their deliveries. the spams i've been receiving
seem to be quite consistent though. and we would keep rejecting them anyway.

we slow down the spammy connections to waste some of the resources of a
spammer. this may slow their campaigns down a bit, leaving a bit more time to
take measures.

we do the same with connections that have their 3rd authentication failure,
typically password guess attempts.

when we accept a message by a first-time sender, we sleep for 15 seconds before
actually delivering them. known-good senders don't have to wait. if the message
turns out to be a spammer, at least we've consumed one of their connections,
and they cannot deliver at too high a rate to us because of the max open
connection limit.

README.md

@@ -16,9 +16,9 @@ Mox features:
 - Reputation tracking, learning (per user) host- and domain-based reputation from
   (Non-)Junk/Non-Junk email.
 - Bayesian spam filtering that learns (per user) from (Non-)Junk email.
-- Greylisting of servers with no/low reputation and questionable email content.
-  Temporarily refused emails are available over IMAP in a special mailbox for a
-  short period, helping with misclassified legimate synchronous
+- Slowing down senders with no/low reputation or questionable email content
+  (similar to greylisting). Rejected emails are stored in a mailbox called Rejects
+  for a short period, helping with misclassified legimate synchronous
   signup/login/transactional emails.
 - Internationalized email, with unicode names in domains and usernames
   ("localparts").