Ask HN: DDos app layer attack, how to protect my site?

I have a temporary email web site and someone is running a coordinated attack / fraud from 15,000+ ips. What they do is run a script that creates an inbox, registers on Facebook and read the auth code. My questions are

1. How can they pull this off? 15K+ ips ??? what are they running to coordinate all of this. and

2. How can I best detect and avoid these ips? Any useful SaaS services / open source libs to identify such attacks. Most of the ips are on exotic places like India, Vietnam, Syria etc