The spam issue on my production server started this week and is coming from a range of IP addresses which are probably that are even faking their host id.

As a quick band-aid fix I have disabled sending emails to any subscriber who is not a registered customer. The BIS notifications are still logged and I can delete the trash subscriptions via PHPMyAdmin.

====
prod env: zc 156a; Apache 2.4.29; PHP 7.2.24; MySQL 5.7.32