And the articles are using the default cache selection
Edit an article and look at the cache time under publish options.
Is that the same as Spam-X? If not, can you link me to it, along with the SFS database of IPs.
No Spam-X is a different plugin. Here is the latest ban plugin
https://www.geeklog.net/downloads/index.php/file_ban_plugin-2.0.5
Please note with the ban plugin you will need to download the latest SFS IP database. This can be done in the plugin. Unfortunately I've had this update process not work on some web hosts or throw an error even if it does work (it has to download a zip file, extract it and then delete the zip file)
The Ban plugin will also work with the GUS plugin to check for other bad behavior's and ban ips automatically. I don't think you should install the GUS plugin though as it may slightly slow down your site.
Another option is to add a firewall rules to your htaccess file to help block bad behaving IPs. This is the one I use:
https://perishablepress.com/7g-firewall/
One of the Geeklog Core Developers.