[Mailsec] Retaining CLIENTID type and token after successful AUTH ?

[Andrew C Aitchison <[e-mail]>]

The last of the restrictions in section 4 is:
     Several SMTP service extensions such as [AUTH] require that an
     SMTP session be reset to an initial state under conditions
     such as after applying a security layer.  An SMTP server MUST
     discard any CLIENTID information after such a reset.

This text appears to be saying that once the AUTH has succeeded
the session MUST not have or make use of the CLIENTID information.

Does that mean that I cannot separately rate-limit messages or recipients
between two sessions from the same user that have different CLIENTID values ?

In fact it appears that the only signal I can use to block one clientid 
but not another is CLIENTID and AUTH attempts. When I notice that
clientid_1 is sending bad or too much mail, the AUTH has already happened
so the clientid is not available to put a block on just clientid_1,
so when the same user with clientid_2 attempts to send an email, they 
will be blocked too ?

Or am I misreading that restriction ?

-- 
Andrew C. Aitchison                      Kendal, UK
                    [e-mail]