Sorry guys, I am still working on it. Unfortunately due to the nature of DDoS attacks it's difficult to stop this from happening. The attacks come from multiple points, and even when I block them they just spring up again from another location. They also don't advertise themselves as attacks... they look like ordinary website traffic... just a lot of it.
At this point I am blocking Russian and Chinese IP addresses on sight. The attacks are coming from the United States and Europe as well, but I'm nervous about blocking IP addresses from those areas because I might accidentally block legitimate users.