It really depends how they attack. They might have found some URLs that require a lot more resources (CPU or I/O) than your normal user behavior.