The attack discussed in the blog post was an HTTP attack, so reflection and amplification were not involved. The attacking machines are most likely infected, and can be labeled and tracked.