running an email system using roundcube, with about 200 people using it.

99% of them do as they are told and only email clients they have already spoken to, however 1% of them decide to bulk spam bcc emails, which then tripped an aol filter and almost got us banned from our host.

I have disabled the guys account but I am worried about something similar happening in the future, what would be the best way to stop this?

I read that if aol recieve 3 emails within 60 seconds from the same ip address then its an instant ban, so i am guessing with the big companies like google, their email accounts must have different ip addresses? and if so is there any way to implement a similar feature?

Also i have spam assasin enabled, in this case what would be the best configuration for it?