Since moving a host to another IP address practically requires temporarily setting a low TTL (which may have been what actually caused the DDoS), creating an entirely new domain with a high TTL is a reasonable (albeit desperate) attempt to reduce the load on the authoritative nameserver. I doubt it's a lack of technical knowledge as much as it is lack of resources in what amounts to a perfect storm (hot potato content, inherent DNS weakness, scalability during surge of popularity, etc.).