xenforo vulnerability, limit max open connections by ip address
I have an old post from March 2012 that limits a specific user's connections by the hour

How can I limit MySQL connections?

You also need to remove anonymous users : Cannot drop anonymous user from mysql.user

Get rid of test user access : MySQL : Why are there &quot;test&quot; entries in mysql.db?

Get rid of all users with no password with

DELETE FROM mysql.user WHERE password='';
FLUSH PRIVILEGES;


You could add a blanket rule on a specific IP addr (like 10.20.30.40)

INSERT INTO mysql.user SET
user='',host='10.20.30.40',
max_user_connections = 1,
max_connections = 1;
FLUSH PRIVILEGES;


Give Them a Try !!!