###########Block User#############
logfile /path/to/log 0644
if
($received_protocol is "local"
or $received_protocol is "smtp"
or $received_protocol is "smtps"
or $received_protocol is "esmtp"
or $received_protocol is "esmtpa"
or $received_protocol is "esmtps"
or $received_protocol is "esmtpsa")
and ("$h_to:, $h_cc:" contains "$User")
or ("$h_from:" contains "$User")
then
logwrite "$tod_full $message_id from $sender_address contained $User (Cpanel User) keywords"
seen finish
endif

#####################Block User#####################

ben
phil
john
joe
Ali