We've got zero flood protection in our CTCP module at the moment. This is a well known attack, so shouldn't be too hard to mitigate.