Blacklist/Block source spam

==== Required information ====
- iRedMail version: Latest
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Linux/BSD distribution name and version: CentOS 5.6
- Related log if you're reporting an issue:
====

Hi,

Today I have a user with a trojan that send hundreds of spam mail from his account.

I try in order:

- Blacklist his IP from IredAdmin and for some reason NOT work
- Then I blacklist the sender and NOT work
- Then I suspend whole domain and again NOT work

Finally, I suspend only the USER and the unsolicited mail stopped.

Why the previously action not work?

Thanks...