Just a warning based on our results.

So far today, more than 2000 messages using more than 1000 email domain names and more than 1000 unique HELO names from slightly less than 500  unique IP addresses.   Started about 8am local time, and has varied between 100 and 250 per hour since then, with no evidence of stopping.   Google's poor client control makes them an attractive attack platform, and we suffer!

The domain names are impersonations, so we are containing the attacks by having Declude delete messages that we would normally send to quarantine.

The one consistent feature is that the reverse DNS is accurate (*.*.*.*.bc.googleusercontent.com), but we cannot easily use that to block messages because our gateway is currently SmarterMail, and it does not implement SMTP blocks based on the Reverse DNS name.  The defense is also made difficult because we have a couple of legitimate senders that use googleusercontent.com.