At that site, the Internet-reachable machines all ran either OpenBSD or FreeBSD. Only two FreeBSD boxes were contacted.
They were hungry for root, so having PermitRootLogin no in your sshd config anywhere Internet facing proved to be a good idea.
We hadn't forced our users to keys only, but a bit of luck and John the Ripper (/usr/ports/security/john) saved our behinds.
The number of attempts per user name had decreased over time (graph), so we speculated in the second article Into a new year, slowly pounding the gates (on slashdot as The Slow Bruteforce Botnet(s) May Be Learning) that success or not was measured at C&C, resources allocated accordingly.
With the sequence not completed, we thought they'd given up. After all, the odds against succeeding seemed monumental.
After all, a couple of slashdotted blog posts couldn't have hurt, could they?