Actually, greylisting should be done on End-Of-Message state. On rcpt
stage, there is no information of *ALL* recipients for a message or you
need to check greylisting after *each* recipient which might be bad
especially if remote SMTP server terminates connection after the first
error received (many lame php SMTP servers acts like this).
Greylisting on DATA is good but on End-Of-Data you can greylist by
content which is extremely useful when you have SMTP senders from
different networks (like gmail, for example).
--
Vsevolod Stakhov