Yup, Once we got over 400,000 hits for several days in a row. There's not really too much you can do. I heard someone suggest setting up a redirect on authorization failures that makes it look like they got in (fake members page). I haven't tried it myself, but it sounds like it has fun possibilities.
