6
Protector protects only in some cases when 'regular' users start to post. There is the number of requests, but limiting it too far will harm access to modules with rich content.
And there is the number of links in a post, but limiting it too far will harm regular article posting.
You must seek your Apache logs for repeating patterns, typical originating from several IP addresses when a bot net is used. If you have them still available from the week where the postings were done, I could take a look at them.
