added repeat offenders monitoring

.env.example

@@ -25,6 +25,15 @@ JOURNAL_UNIT=mailserver
 # outside these ranges are flagged in the report as noteworthy.
 TRUSTED_LOGIN_NETWORKS=10.0.0.0/24
 
+# --- Multi-day repeat-offender tracking ---
+# Requires the /data mount added to the systemd unit (bind-mounted, read-write)
+# so this state survives across container restarts/daily runs.
+STATE_FILE=/data/offender_state.json
+# An IP gets called out as a repeat offender once seen on this many distinct days
+REPEAT_OFFENDER_THRESHOLD_DAYS=3
+# IPs not seen again within this many days are dropped from tracking
+OFFENDER_RETENTION_DAYS=30
+
 # --- Execution Options ---
 # Set to 'true' to see detailed background processes, 'false' for clean logs
 DEBUG=true