I really hope they have blocked all unused ports. That is a pretty common way of DDoS. Also TCP flood as well.
Another thing they should check into is rate limit per IP source and this rate limit should include SYN FIN ACK and RST per second per source IP. They will also need to limit the concurrent connections per source IP. Another thing these DDoS attackers may be doing is sending login command at the same time.
Scripted attacks have many anomalies in their headers. This should be looked at as well.
In the logs, please be looking for similarities in the attacks. Most attackers will change parameters but they usually dont get all of the parameters and alot of these parameters remain the same across the board.
Another of the easiest solutions is start blocking IPs at the router/firewall level. Start getting a good list together and eventually this will stop.
Worst comes to worst and they really want to stop these attacks, they can hire a specialist whose soul purpose is DDoS mitigation.