regarding the IP access control list, you may have heard of a little thing called "fail2ban" which is the kind of IP address rate limit/access control system i would recommend, if a relay really is getting that much unwanted traffic there are dedicated tools and ratelimiters for this that shield the relay