If they are SOCKS5 servers, there probably will not be any external fingerprints you can find in the FTP activity that comes to your FTP server. (Other protocols like SMTP have a couple clues). In other words, a SOCKS5 proxied connection strictly obeys the principle of "transparency".
(There could be very small, TCP-level clues, that are vendor specific, but this is unlikely).
How do you know they are SOCKS5 servers? (Are you able to connect to the servers with a client that support SOCKS5?). If they require authentication, then you should be able to work with the administrator of the proxy. If you cannot, you could ban traffic from that IP address.
The same could be said of a VPN, because they often have logging as well.
However, the most important question is the nature of the suspected proxy's administrator. If they are legitimate, you can work with them. (As administrators, they both have the responsibility and expertise to help you out). I find the problem description is unusual, most people are attacked via botnets, where many hijacked computers are the source of the traffic. In those cases, there is no administrative counter-party (unless it is a single company full of infected Windows desktops) that can help you.