[2314] 13:25:57 >>> 250-mail2.centralhome.com Hello BrhZSUb0c [], pleased to meet you. [2314] 13:25:58 <<< AUTH LOGIN
cut user & pw [2314] 13:26:01 >>> 535 5.7.8 Authentication credentials invalid

The IP stays the same but the hello "BrhZSUb0c" changes on every login attempt. There are about 10 per minute and this went on for 10 minutes, so about 100 failed login attempts.

I have this set at 5 "Block IP address that exceeded number of failed login attempts".
I ticked process SMTP and POP3/IMAP.

Are these getting though because he changes helo name, IceWarp is bad at counting or did I miss something?