Re: It is happening now
It certainly is.
The number of attempts to log in to my email servers via SMTP, 2ry SMTP, IMAP and POP3 are through the roof.
In the past, it would be the same IP trying over and over (though there's still plenty of that), but it's now also common to see an IP try once and then disappear. And lots of those IPs are part of cloud providers networks.
Not only that, but the spam is also coming from an increasing range of IP addresses.
I've had to further reduce the limit on failed login attempts, as well as begin firewall blocking of IP ranges wholesale.