I received a message about a customer account mail rely and that there was a compromised word press script on their site. So I tried the following:
Suspending the email accounts it didn't work.
Blocking the I.P.'s, but they seem to have changed faster than I could block them.
So, I finally...