Short of blocking hotmail.com completely, what can be done to deal with Hotmail spam? Here are a couple of ideas I've used with great success.
1. Delete all messages sent from or relayed through Hotmail using a blind CC.
Go into Configuration -> Filtering Rules -> Edit global rules
Create an Expression and enter "@your_domain_name", check Headers only, Action: Logical AND operator, click Ok, then click the NOT button.
Directly after this statement, create another Expression and enter "bay0.hotmail.com", Headers only, Action: Delete message.
How many businesses send legitimate messages from Hotmail accounts using a blind CC:? I've not seen any.
2. Check for patterns.
One of the spammers using Hotmail lumps around 20-30 addresses to various domains in the To: or CC: headers, along with one legitimate address on my system. I was looking at these and it dawned on me the spammer was using the same list of names over and over again for months now. I set up a rule to tag on one of these other addresses and delete any message with that address in the header. Obviously, you'll want to check to make sure the address you choose is not someone sending mail to or from your system, but odds are the other victims are people who no one using your system know.
Hope this helps and of course, your mileage may vary.