The technique of doing packet level inspection is very interesting. I don't agree that "ham tends to come from computers that have a lot of channels, or ports, open for communication". The ips could have easily been allocated to a new customer by the time they were able to check for open ports. I believe ham comes from legitimate edge mail servers.
