Policyd for Postfix makes it possible to throttle users, is quite straightforward to set up and is easy on server resources.
This used to be very effective, but with the latest trends of spamming techniques throttling is now trickier; a common technique seems to be to steal the account information by using some malware, and login as that user.
Then the spammers just login, send out an e-mail with 50 or so recipients, log off, wait for a while, and login from another IP address, repeating the process with the same or another user account. Often the e-mail itself looks clean, it can be a copy of some press release or something not-so-easy to catch.
How to throttle those? Stopping unauthenticated spam is doable, but stopping a (in theory) trusted user ain't easy. I've been pondering about that, too. Setting up recipient restrictions can be harmful for normal users -- someone easily can add 50 recipients if sending out an invitation to a birthday/wedding party or something similar and completely innocent.
So, first you need to figure out if it's a human or a bot trying to send spam.
One way to do that is to utilize Apache's mod_security and make it lookup RBL lists. If users IP is at some banned list, don't allow a login straight away, but present a CAPTCHA or something similar first. If CAPTCHA is solved, then add users IP address to a local whitelist and allow the login.
This is easier than it sounds; relax mod_security only to perform RBL lookups and not do much else, and then set it up to first look at the your local IP address whitelist file. If the address is not found in there but it's present in some global blacklist, then return http code 403 (permission denied). Configure your Apache's 403 page to be that CAPTCHA page.