We were hit with a web request flood attack today
One user was slamming the server with web requests, including image upload spam to load the server with image reprocessing.
Server slowed to a crawl until I was able to identify the user and freeze their account.
Really wish I had better admin tools to help diagnose these types of attacks :(