Hello
I apologize, but I wasn't able to get a solution working for you. We've seen these kinds of attacks against many of our customers that use Wordpress. I was trying to rewrite a cookie & javascript based fix to work for you. However, due to your site's custom .htaccess rule, everything I tried would merely break your site.
This is one of the main reasons coding is outside our scope of support; we don't want to accidentally break your sites.
The only protection I can think of that I know will work would be to institute an .htpasswd prompt for all 'POST' requests. Considering that your site is a forum, almost all of the users are sending 'POST' requests. The problem is that the attackers are doing the same thing. It's hard to differentiate between the two.
If we make a password prompt, it will provide the credentials on the screen. Your normal users can read the credentials; a bot will not be able to.
To make the password prompt have less of an impact for your site visitors, they will need to select 'remember password' in their browser. Otherwise, they will get the password prompt every time they post.
I know that it's a little intrusive on the user experience, but it's the only thing I can think of that will keep the site up during an attack. My advice would that you only enable it during an active attack. You can add/remove the block code directly in your .htaccess, so you won't even need to contact us to enable/disable it.
If you are interested in this, let me know and I can provide you with an .htaccess code that will work. Otherwise, you'll need to consult a coder that specifically has experience with Apache directives and filtering out requests.
