>> then started blocking their IPs in the blacklist.
>
> Useless, unfortunately. They're trying SMTP AUTH, which bypasses the
> blacklist when successful. Only way to stop that is to block 'em at the
> firewall. I have most of Asia unable to even get to my SMTP port after
> several such experiences. Be aware they'll likely try POP too....

Funny but when I blocked them in the blacklist they stopped.  Maybe they
just gave up at the right moment.
One thing I _did_ notice was that when I added one to the blacklist it
would stop and a _similar_ IP would start.  I blocked about four or five
then they gave up.

Mike Hebel
----
"I think we used too much!" - Chris Knight