Concur with @Matteo's answer; what you're seeing is essentially thousands of zombie'd systems executing a distributed brute-force attack on your server because there is a website running on it, which means there may be users that might have a login account that might possibly be guessed with minimal effort on the part of the script kiddie - he's got a program that orders the thousands of zombies to make the bruteforce attempts on a few hundred website hosts at a time and just compile a list of the successful returns.
Similarly, you may sometimes see lots of permuations of "http://your.web.host/phpmyadmin/" in your
/var/log/apache2/access.log files; these are automated scans for the most common ways of setting up PHPMyAdmin, and will attempt a number of known exploits if one is found (this, incidentally, is why I've started telling customers to please use the PMA site I personally set up and keep up to date rather than installing their own version and forgetting to keep it updated, but now we're off on a tangent).
Aside from sending out the original command, it doesn't even cost him time or bandwidth; it's fire and forget.
Another very useful bit of software for situations like this is fail2ban, which uses iptables to block connection attempts after multiple clearly false logon or other exploit attempts.