Could you counter equally naively, does a single IP need to hit your site more than a couple of times in 10mins, say?

Still even an simple test could be too slow to counter a big enough attack.