Is there any reason why you dont shut the client down until you sort these problems? Its literally unplayable as it stands and you just get more and more work to do with all these cancelations/refunds etc while you should focus all your effort to protect from these attacks. Just my 2 cents.