tagging, ignoring, or reporting "bad user". (DNSBL-based "session refusal"
occurs before SMTP authentication can take place)