The Password Brute Force by Email IDS rules should be doing what you want for the second point. However, keep in mind that IDS rules and related blocks are bypassed for connections with an applicable whitelist entry. For a whitelist entry to be applicable, it needs to match the client's IP and the protocol being used for the connection. Also, connections that register as localhost, 127.0.0.7, or ::1 always bypass IDS.
Andrew Barker
Software Developer
SmarterTools Inc.
www.smartertools.com