DDoS attack
. To be honest, I've wondered about that as well and couldn't really explain it.
I did change the way the system counts the number of online users after that, though. This to make it more realistic. The system used to "assume" that a user was online for at least 15 mins and then count the peak that way. I changed to the assumption of 5 mins, figuring that even the longest thread would not be read for more than 5 mins by our average user. So nr of online user count dropped after that, but is much more realistic.
Peter