I had the same problem on two of my blogs.
I downloaded ‘Enable jQuery Migrate Helper’ and activated it. It fixed the problem in both cases.
Sorry it didn’t work for @logicindustries, but my thanks to them for mentioning the plugin.
I learned from Stackexchange that the answer to question 1 is xml-rpc.
I disabled xml-rpc with a plugin and all attempts have ceased. I can live without pingbacks. I’ll watch for what else might be affected, but as I’ve left the htaccess ‘login from only my fixed IP’ in place it looks good now.
