Sending an email to [email protected] does actually work.
A few days ago, a site hosted by DigitalOcean was banging away on my ssh honeypot so I let them know. Less than 24 hours later the site was taken offline and is still offline. Well done guys!
It wasn’t actually sending userid/password combos, otherwise I would have let it go to keep collecting that information. Broken script possibly?