I usually do it all in awk:
awk '/mail/ && NR <= 500 {...}' access.log
awk '/mail/ && i < 500 {i++; ...}' access.log