Looking at the following line, how do I know which email account caused the firewall block:
vps lfd[18170]: (smtpauth) Failed SMTP AUTH login from 196.214.185.114 (ZA/South Africa/dc1.mesure.co.za): 5 in the last 300 secs - *Blocked in csf* [LF_SMTPAUTH]