Actually, it has been helping to detect which workstations or hosts are sending spam. Let's copy below script and paste the script in new terminal.
/ip firewall filter
add action=add-src-to-address-list address-list=spammer address-list-timeout=\
1d chain=forward comment="spam 25 port listing rules" connection-limit=\
60,32 dst-port=25 protocol=tcp
add action=drop chain=forward comment="spammer's mail deny" dst-port=25 \
protocol=tcp src-address-list=spammer
Or
/ip firewall filter
add action=add-src-to-address-list address-list=spammer address-list-timeout=\
1d chain=forward comment="25 port listing rules" connection-limit=60,32 \
dst-port=25 limit=60,5 protocol=tcp
add action=drop chain=forward comment="spammer's mail" dst-port=25 protocol=\
tcp src-address-list=spammer