Um, what the hell is sshd MaxStartups?!
Is this like "kiddies get to lock the admin out of their own server by spamming it with login attempts" ?
I have a laptop in the corner of the room and ended up unable to shell it, had to open it up and reboot which is annoying because it's in an awkward place. Could have been worse... Upped the value to 1000 and disabled ChallengeResponse auth which is probably what was attracting so much attention...