Depends on where he in coming from and who the ISP is. If the DHCP set up (there's some of them trick admin words) for only one Class C, he could be any of maybe 240 ~250 addresses. It goes up from there. If it's a Class B, it'd be one of maybe 65,000. When your DHCP lease runs out, you may get your same IP and you may not. So you block the whole block and 64,999 people suffer. I just had this issue with a faculty member that was on vacation in Russia. He could not connect back to the university because he was behind a giant block of banned IPs. THat's what he gets for hanging out in spam country. Over an above that, these guys may have access to a gazillion hijacked accounts or computers, all in different IP address spaces. They do like to stick to easy targets, so a little resistance and they go elsewhere. Hopefully.
What Travis said - Firefox also just patched a **** load of "drive by" flaws. If the bad guys score a zero day flaw in a browser and you hit the wrong web site before an update cycle...tag, you're it. It's that bad out there.