Thanks for your suggestion, Lugh. My 2 bombed accounts are in Windows Live Mail, formerly Outlook Express. Sucuri always picks them up as "failed logins", but they arrive in my inbox.

I'm going to try just junking them as they come in instead of trying to block the ever-changing IP addresses.