You need to impose cost. Set up QoS buckets, slow suspect connections down dramatically (almost to the point of timeout).