[ethan_smith]

This is almost certainly subscription bombing / email bombing. The goal is to flood someone's inbox with hundreds of legitimate-looking automated emails so they miss a real one - typically a password reset confirmation, a purchase receipt, or a "new device login" alert. The actual attack is happening on some other service where the victim has an account. The fact that you don't see it on your server doesn't mean much, the target is the victim's primary inbox elsewhere.

[avian]

Thanks. It might still turn out to be this.

My thinking so far against was 1) after a few months I'm pretty sure I would hear about the real attack 2) Repeating too frequently. People aren't getting hacked all the time (I hope).

But who knows? Now I'm thinking that maybe some other step in the attack is failing and maybe the attackers just trigger the email bomb part pre-emptively in case they actually succeed in resetting the password/purchasing/whatever.