Maybe it is a lack of info or differentiation between the different attack vectors, but it sounds like you actually have it under control if the business is not being impacted.
Are they "testing" your security, or spamming from your service, or spamming to your service?
Are they "testing" your security, or spamming from your service, or spamming to your service?