This is an extremely good idea. I hadn't heard of (or thought of) this sort of attack with email accounts, but of course it will happen.

Pretty much the same thing as with many other online accounts, where usernames and email addresses are intentionally not identical.

And when the username is entered, a password should be requested, without the end-user being told whether or not the username is valid.

I think SM and other email providers need to think seriously about implementing this, as it most certainly can add another layer of security. 

Not foolproof, but seems completely reasonable to me.

For anyone having these issues and trying to find a solution, read below.

I've been having lots of issues with this, ever since posting here. My colleagues mailbox and mine are obviously targeted so, we get a blocked mailbox several times per day. Smartermail developers seem to ignore this request completely.

Today I came up with the idea to rename our mailboxed and use some other address for the mailbox, that noone knows about, then create an alias to point to that mailbox. This way the user can log in with "user-randomstring@domain.com" and give out the email address "user@domain.com" which is actually an alias. You can't login with an alias so... We have a solution.

Smartermail has an option to rename an existing mailbox, so that's good !
Steps:

1. rename your existing mailbox from "user" to "user-randomstring" or whatever you want to login with. Keep this address private, don't list it, don't share it. This is your new username that nobody should know.

2. create an alias for "user" to point to your renamed mailbox. For this alias, enable the option to use it as "From" address. You will need this if you use webmail, to make outgoing emails from the renamed mailbox to use the alias address instead.

3. reconfigure your mailbox to use the alias address as "From address"

4. reconfigure your email clients to use your renamed mailbox address as username and keep you alias as your "From" address.

That's it. Now it not so damn easy for someone to block your mailbox x times a day. Or to crack your mailbox, which would be much worse.

I still think it would be much better (and easier and more safe) for users if Smartermail developers would implement a separate "username" for mailbox and discontinue the use of email address as the username (or give an option to turn that off, for us to have a more secure mailbox). But in the mean time - while we are waiting for the sun to shine on this one - you can use this trick with alias to achieve the same result. For a limited amount of mailboxes it's doable.

Cheers,
David

We have used the solution described by David for years with victim mailboxes even before we moved to SM. MailEnable was even less able to handle situations like this. 

It's a VERY effective means to combat the problem. Integrated with an external solution, and you can instantly block IPs that are attacking the alias rather than let them continue to abuse the server.

The only issue I see with that method is that the "envelope" address in emails sent by that user will match the user's login name. This can of course be gleaned from the header of any emails then sent by that user. But a hacker would need to see a received email sent by the user and dig into the header, so it's still a reasonably effective workaround.

Better than nothing, but implementing something where the login name is completely different still seems a great idea.