Deny any email from web scripts or users via localhost. Only root can send it

A lot of the issue and issues with the spam can happen if the user can send the emails without authorization. In order to prevent the issue, we can block them:

In the end of acl_check_not_smtp, before accept section need to add the following code:
#############################
accept condition = ${if eq{$originator_uid}{0}}
drop message = Local users can't send mail
#############################

It will prevent all emails except the emails from the root.

The second way, you can limit it, via the following lines:
#############################
deny message = Sender rate overlimit - $sender_rate / $sender_rate_period
ratelimit = 10 / 1h / strict
#############################

It means that only 10 emails can be sent via users or web scripts without authorization in 1 hour.

But only 1 way can be used, it is not possible to mix it.