Inbound throttling based on IP/Domain reputation would be the better option, essentially creating a reputation system like Microsoft/Google have that looks at volume patterns. You would feed in the data from SM installs around the world (opt-in of course) then build up a database.

At the moment I don't believe SM records enough statistical data about the source of email/connection which is where the problem is. If they added the stats data we could write something that would essentially populate a rbldnsd dataset then just use that as a RBL in SM.

If they were really smart :) they would have the SM installs pushing the local volume stats data to a central system via an API, process it and update their own central database then push it out to multiple rbldnsd instances at frequent intervals e.g. every hour or so. Just requires a good level of design especially when it comes to processing large amounts of data. When the SM instance is pushing stats data to SM’s API it would only push stats data accumulated after the last time it sent data to SM to keep the requests small. SM installs could then use the RBL/URIBL’s created by SM to apply to inbound connections/emails.

You want stats like connection volume within x period, how many unknown users; you need to look at IP level and CIDR, IPv6 support along with sending domain etc