They need to set up an max connection per ip,
Or anti Q3Fill function.

Easy fixable, google Q3fill counter/fix.

Goodluck TWC