Wow, that's next level. I haven't been the target of that yet /crossfingers
How is it travelling to you? Are they using VPS's, email sending services or Gmail/Outlook? VPS's can be fenced but the later is difficult to block without affecting legitimate traffic.