Ah! So this is what was happening to my XEP-0065 server last night.

http://sock-raw.org/papers/abusing_network_protocols