This is why AAA is so important.
The problem is that an ISP can do all the source filtering it wants,
but if it only blocks SYNs to port 25 all it takes is one unfiltered
dial-up to spoof that ISP's addresses.
--Steven M. Bellovin, Steven M. Bellovin