No Worries, @Habitual! I realise I was barking up the wrong tree with the IP spoofing theory, and didn't realise how difficult (if not impossible) it would be to find the right one. Chopping that tree down and planting a new one is the way to go, though I'd still love to know how the blighters got up my tree in the first place. Am I taking this metaphor too far...?

I did install Webmin right at the start (2 years ago), but actually find myself doing most stuff from the command line now. Do you recommend avoiding Webmin, CPanel, Plesk et al completely, or is there a place for them?

I've tilted at more than a few windmills.
Are you asking me, or descendant_command about control panels?
If you're not using webmin (c-line is, and always will be King) nuke it to orbit.

How they got "into" your tree...
Find out where it's originating and that should lead to the "how" of it.

Any time you expose administrator functions and capabilities via a web interface one is asking for their server to get owned. Feel free to search NVD for your favorite software. https://web.nvd.nist.gov/view/vuln/search