there seem to be many interesting discussions on secondary MX and spam
relays. basically, secondary MXes normally do not check the existence
of accounts (like foo(_at_)itojun(_dot_)org) and it will get queued,
while primary
MX can reject it at instant. this may be ASRG topic, but i guess
there's something to be done in SMTP level.
some mailing list (do not remember which) even showed the attack ratio
against secondary MX and primary MX, and secondary MX is attacked
much frequently.
http://www.google.com/search?q=mx+secondary+spam&sourceid=mozilla-search&start=0&start=0&ie=utf-8&oe=utf-8
itojun