I got a number like that on an ASG one time... it turns out that statistic (looks like that's a capture from ACC) also counts failed SSH logins.. take a look at your SSH logs... I'll bet you see a brute force attempt going on. Limit access to SSH in the System Settings. I find that WebAdmin generally isn't that attractive of a brute force password attack vector, as the default config blacklists 3 bad attempts for 300 seconds (I up this number).
