--
-- top 10 users receiving the most spam
--
SELECT rcpt_to, count(*) AS count FROM mta_delivery
JOIN mta_accept ON mta_accept.mta_accept_id = mta_delivery.mta_accept_id
JOIN mta_connection ON mta_accept.mta_conn_id = mta_connection.mta_conn_id
WHERE spam_result='spam' AND
  connect_time >= :start_date AND
  connect_time < :end_date
GROUP BY rcpt_to
ORDER BY count(*) DESC
LIMIT 10