The article mention the use of lambda/serverless. If he had a server many of these issues would not exist in the first place :)
And I does not looks like a DDoS either, this amount of connections is quite normal for mid-sized apps, and connections can be kept open in case you app is slow, making your stats higher than it actually should be.
Btw, two servers plus a bit of architecture simplification solves this and cut the costs down to ~$400 or less.