Hello saguaros.
Figured out that the default login page was still available through a hidden link (not hidden to web trollers). I added a Google Captcha to that page. Was also able to run a log of the URL's of visitors to the site, was able to identify the bad actors, then blocked those that were causing the mischief. Seems to be working well.
Thank you for responding!
Sincerely.