GWIA sending out SPAM

we recently cam under attack from a spammer who's using our system to relay SPAM messages. I have not figured out of they're doing some sort of smtp hacking, or using a groupwise username/password to gain access. I did see an Ip address in the SPAM server log "208.98.175.242" which is also in a blacklist. The sender isn't using our domain to send the spam, they've been using "online_update@halifax.co.uk" as the sender address. how do I go about blocking any connections from that IP address???

GroupWise 8.0.2
M+ Guardian SPAM filter