i just finished writing a c api extension manager (my first one) that intercepts any message dropped into a servers mailbox and shifts it into another database, based on an INI setting it can selectively intercept notes, internet, blacklisted, or all mail.
i wrote it because i wanted to create my own spam filter, but that'll be a seperate add-in. i'd like to trust the rbl's as a first line of defense but i'm not sure yet, which is why i'm still at log and tag, at least this way i can keep an eye on what would have been deleted and restore it if necessary without letting it end up in users mail files.
it's written for the win32 platform but i'll add the source code here tomorrow (it's here

i also looked at creating a whitelist function but it seems that while i can get at each smtp connection event from the api and let them in if they're in the whitelist, you end up bypasssing both the rbl check as well as the relay check, and you don't really want these people to be able to relay off your server, bit of an oversite on lotus' part there.
btw. does anyone know if there is a place to get/store c api addins equivalent to the sandbox, or should i just sumbit them in there?