The traffic was real.
The images being requested from the useravatars directory were because some members posting in a popular thread have avatars in their profiles that apparently are supposed to be in the useravatars directory. They may have had avatars in there at one point but the directory is empty now - so the files were not found. (Perhaps I overwrote the directory and deleted the files during a previous upgrade?)
There was other stuff happening at the same time that was related to intrusions and the multiple requests for non-existent files looked a lot like other incidents I have had with spam bots in the past. So I thought initially that the events were related - they were not.
If anyone has a solution for DOS attacks other than banning each IP - please share. It will probably come in handy in the future anyway as this thread would be found by others who really do have the problem
