Having had to deal with shit like this before, I can aver that blackholing the offenders is the highest-performance option.

In other words, you did right. Look into mod_dosevasive if you want to automate this sort of thing (and rechecking IPs every few hours/days/whatever). Note however that if you have a malicious attacker they will forge headers; of course if they're really malicious they'll just SYN-flood you like that.