I am sincerely not discouraging you from continuing down the path you are going, however one thing you might want to look into is checking to verify that the information you are wanting to parse is located within /var/log/messages or /var/log/maillog. If sendmail is logging conversations to the latter, you can use perl to read over the last n lines of that (much more specific) log and take action.
If you're looking for a good base on what others have done for the goal you're aiming towards, take a look at spamshield, which although not perfect could give you a good base to work up from.
Sorry for not answering your question directly, but I've been in your shoes and I think there might be a less intensive way to do it.

humbly -c