It's interesting that a spike of 30k login attempts in a short time is enough to set off alarm bells. It makes me wonder what kind of attacks fly under the radar in larger systems.