reject calls with helo/ehlo strings of "localhost",
"localhost.localdomain" or "localhost.example.com".
these are never legit, and are always the mark of a spammer.
one can imagine other possibilities, such as 127.0.0.1.