This observation matches with this: Spam for Lead Generation?
Are you able to see the IP addresses of send-magic-link requests? Can you check if they are also from Tor network? Maybe attacker is now checking another mail list.
1 Like