diff --git a/Files/mailserver/cron/warn-too-many-smtp-login-hosts b/Files/mailserver/cron/warn-too-many-smtp-login-hosts
index ae22ca57bafa59a658c45db50832d2987ca39b64..048f96ea4d6f8206daa1b65a82aaba8fe25d8a5c 100755
--- a/Files/mailserver/cron/warn-too-many-smtp-login-hosts
+++ b/Files/mailserver/cron/warn-too-many-smtp-login-hosts
@@ -6,8 +6,13 @@ BEGIN {
 		skip[line] = 1
 }
 
-/sasl_username/ {
-	addresses[substr($9, 15)][$7] += 1
+!/authentication failed/ && /sasl_username/ {
+	if (NF >= 9) {
+		extracted_user = substr($9, 15)
+		if (extracted_user != "") {
+			addresses[extracted_user][$7] += 1
+		}
+	}
 }
 
 END {