DDoS attacks are not the result of millions of people individually attacking a site, they are almost always the result of small criminal organizations that are controlling botnets that do the attack on compromised systems for-profit. They offer these attack services via market web sites. It's highly likely that this person used one of these markets to execute the attack against the Internet Archive.

It's not easy to go after them, but neither is it easy to go after CP peddlers, and yet we still go after them and arrests are made. It's one part of a many-faceted strategy that will be needed to get some control over a problem that is clearly getting worse.