It has been a rough day for DOSing.

Best protection at the site I think is to force a gateway page with an extremely simple captcha. Like you have on the signup, but maybe simpler. What ever will stop bots but not form an attack vector itself. Use it to deny access to the rest of the site until they pass the captcha. You can limit attempts and also only have the page enable once a certain bandwidth or connection limit is passed, so people usually don't see it.