It started backup the following night. And we have been spammed constantly since. I have it as dark gray numbers on a black background but somehow the spam bots can still read it....
I am open for suggestions at this point.
I would suggest implementing the solution you described in very first post. You may also want modifying it slightly after observing spambot traffic patterns, as we did on this forum - the trick you see is only a top of the iceberg, but (hint, hint!) I will never discuss all the details on public forum.