You don't want to use the Hosts.Rules file... In fact the file will have a new look in v8 and updating can be done through the FTP, but you STILL don't want to use the new Hosts.Rules file!
What you probably want is to enable the 'Reject_Unknown_Ips' option which means the server will ONLY talk to hosts that match at least 1 user hostmask. You also probably want to enable the 'Secure_Ip_#' options to prevent admins from adding *@* as a hostmask which would effectively disable the feature!
I suggest skimming the whole ioFTPD.ini file, there's a ton of cool stuff in there
