I cheated because I (think I) know how to use iptables.

my $LOG = "/path/to/mail.log";
my $IPT = "/sbin/iptables";

my %known = map { $_ => 1 } get_current_offenders();

open LOG, $LOG or warn;
while (<LOG>) {
  if (/User unknown/ ... /\[((?:\d+\.){3}\d+)\]/ || 1) {
    $1 and !$known{$1} and ++$known{$1} and ban($1);
  }
}
close LOG;

sub get_current_offenders
{
  my @offenders;

  # Let the shell have it, it's easy and only happens once
  open IPTABLES, "$IPT -n -LINPUT |" or die;
  while (<IPTABLES>) {
    if (/^REJECT\s+tcp.*?([\d.]{7,})/) {  # Might tweak this
      push @offenders, $1;
    }
  }

  return @offenders;
}

sub ban
{
  my ($offender) = @_;

  # Save ourselves a (not-so-)expensive exec()
  system($IPT, '-A', 'INPUT', '-s', $offender,
         qw( -p tcp -m tcp --dport 25 -j REJECT ));
  $? and warn;
}
[download]