Looking through the logs, I see that more refer spam is showing up. Of course, it all fits a pattern and is easy to drop out of the logs.
SetEnvIfNoCase Referer "^www(.*)" dontlog
SetEnvIfNoCase Referer "^XXXX:\.(.*)" dontlog
If I was more clever, I would block them altogether, but one step at a time.
[Posted with ecto]