Two of mail servers that we monitor are hits with large numbers of spam emails. This time what they do, the spammer compile email addresses from the same domain or organisation and spam the email addresses.
By doing this, they may escape from detection from razor pyzor and dcc. Only if the email users in that organisation make the reports to spamhaus and spamcop the spamming will be stop. It's only may be.
For temporary solution I installed sqlgrey
Read about grey listing here