You have posted a log showing one login attempt every 20 minutes. If that were all that were occurring, you should not have a resource consumption problem. Something else seems to be going on, perhaps caused by the attacker's script.
# systat states will show you IP traffic.
sysutils/pftop will show the same information, but allow you to filter and sort.
If the attacker is flooding the webserver with connection attempts, you could easily block the attacker with PF's
Stateful Tracking Options.