I believe that this problem should not be addressed only at the firewall layer, but at the upper layers by applying control on mail servers and end user operating systems such as antivirus and application execution control.