reject calls with helo/ehlo strings of "localhost",
"localhost.localdomain" or "localhost.example.com".
these are never legit, and are always the mark of a spammer.
one can imagine other possibilities, such as 127.0.0.1.

Reference: /n/sources/patch/applied/smtpd-no-localhost
Date: Mon Jul  4 00:41:01 CES 2005

--- /sys/src/cmd/upas/smtp/smtpd.c	Mon Jul  4 00:39:04 2005
+++ /sys/src/cmd/upas/smtp/smtpd.c	Mon Jul  4 00:38:58 2005
@@ -281,7 +281,17 @@
 			}
 		}
 	}
-		
+	/*
+	 * it is never acceptable to claim to be "localhost",
+	 * "localhost.localdomain" or "localhost.example.com"; only spammers
+	 * do this.  it should be unacceptable to claim any string that doesn't
+	 * look like a domain name (e.g., has at least one dot in it), but
+	 * Microsoft mail software gets this wrong.
+	 */
+	if (strcmp(him, "localhost") == 0 ||
+	    strcmp(him, "localhost.localdomain") == 0 ||
+	    strcmp(him, "localhost.example.com") == 0)
+		goto Liarliar;
 	if(strchr(him, '.') == 0 && nci != nil && strchr(nci->rsys, '.') != nil)
 		him = nci->rsys;