dictionary attacks

Anyone have recommendations for combating dictionary attacks?

I have one domain in particular (keinan.com) that gets constantly
hammered by dictionary attacks.  I have a realrcptto solution
implemented with mailfront's mailrules, so this is mostly just a
nuisance in the logs, except when they hit a real account. It'd be
nice to have something that watched for obvious attempts (maybe
swatch?) and automatically added the IP address to a blacklist to
reject them right at the SMTP connection.  I suppose I could write
something in perl/python to do this, just curious if anyone's already
done anything about this or if you just live with it?

Thanks,

Josh