Talk to your host first. Any decent host will shut that off for you at the server level or show you how to do it.
In fact, I would talk to them about the phishing too... though that setting is lame, it’s by no means the only source of getting hacked. They may be willing to view logs to see who might be hitting your site.
Good luck.