I do think that you have missed one point. These generally are things that go into your email box on Monday and get read on Monday. Generally I bet they originate and are delivered to the first chain in the link to your email box on Sunday. They also are generally probably delivered from machines compromised on Friday night or Saturday.

Interestingly the probes generally come from machines which when I contact their managers were compromised on Thursday might. (Another high volume time for probes)

I find that by far a majority of the probes of my system start a little after 5 local time and stop late afternoon Saturday. I assume these people are trying to put together a bot net and don't want their actions undone by being discovered. So they do their work when they don't think people are watching. They put together a net on Saturday and probably sell it Saturday for use Sunday. They most likely have all day Sunday to get their messages out before someone discovers them and plugs the hole.

So then you get these messages on Monday.

The point of this, I actually tighten my filtering Sunday and find that this is most effective.

Um ... isn't it a drop-kick to institute crypto confirmation (the little "type the letters in this image") to commenting. Oh, there it is below. Problem solved. :) Maybe I'm not understanding how you're getting this spam. I've used munging scripts and methods on my domains for years. Usually I only get spam from contacts without a/v software who've been Trojan'ed.