Would someone really get pissed off enough to do this? It's a damn game, waste your time somewhere else, you DDOSing slime!
Can't Ephi modify RTB to track when people log on to RTB, then compare those readings to when the DDOS starts? Anyone not logged in that day can't be the perp. Do this multiple times, limit the pool more.