Large volume of mail

[iceruam]

I notice a spike in the graph:
Number of recipients of messages via either SMTP or LMTP.
The graph is basically flat-lined at 400-450 every hour, except for 1 hour during the day, and this varies, not always the same hour, I see a spike that shows we sent 2000-3000 emails during that hour?
What log can I look at to see what these may be? I checked mail.log but do not see that many. but do see this entry which seems like it might have something to do with it:
Jul 21 10:25:31 zmail5 postfix/anvil[4763]: statistics: max connection rate 1/60s for (smtp:108.62.112.110) at Jul 21 10:18:26
Jul 21 10:25:31 zmail5 postfix/anvil[4763]: statistics: max connection count 1 for (smtp:108.62.112.110) at Jul 21 10:18:26
Jul 21 10:25:31 zmail5 postfix/anvil[4763]: statistics: max cache size 2 at Jul 21 10:18:38
maybe?

[meuchel]

i would like to revive this as i have seen the exact same type of cases.
i would like to add that in my instance several lines above stated log i also get a block from the same ip on spamhaus rbl.
May 21 17:09:57 mail postfix/smtpd[16891]: connect from 66-118-151-30.static.sagonet.net[66.118.151.30]
May 21 17:09:57 mail postfix/smtpd[16891]: NOQUEUE: reject: RCPT from 66-118-151-30.static.sagonet.net[66.118.151.30]: 554 5.7.1 Service unavailable; Client host [66.118.151.30] blocked using zen.spamhaus.org; http://www.spamhaus.org/query/bl?ip=66.118.151.30 / The Spamhaus Project - CSS from=<Alexandra@remote.epdmo-rings.com> to=<MY EMAIL ADDRESS REMOVED> proto=ESMTP helo=<remote.epdmo-rings.com>
May 21 17:09:59 mail postfix/smtpd[16891]: disconnect from 66-118-151-30.static.sagonet.net[66.118.151.30]


is zimbra still processing mail that should be dropped due to rbl block?