@ColinTheMathmo yep. Lots and lots of requests trying to get in, and deleting the offending user account stopped it.