mcavic - 5:57 am on Dec 6, 2008 (gmt 0)

I'd suspect that sshd is still listening on the default port as well as the custom one. 10,000 attempts on a custom port seems quite unusual. Also, LogWatch shouldn't report attempts on invalid ports, unless it's reading an iptables log (and by default, there isn't an iptables log).