By using a spoofed IP address and repeatedly sending purposely assembled SYN packets, followed by many ACK packets, attackers can cause the server to consume large amounts of resources keeping track of the bogus connections.
Impersonating a different IP address was not difficult prior to RFC 1948, when the initial sequence number was easily guessable.