No, it's just someone pointing a small botnet at the web login (about 300-400 bots)
Not a concern for mining itself, just for anyone who has a simple password.
I don't know what anyone's password is, but it would seem they managed to guess (at least) one, since one person contacted me about it and then changed their password and added 2FA (and undid the payout address change that notified them of what happened)
I blocked the full subnet (forever) that the 'hacker' logged in from, the bots themselves get blocked pretty quickly, but not all at once - since they're of course not in one subnet, but in many - so I simply block all logins for a while if I happen to see it.
Thanks for the explanation. Clean, as usual. Mine on...