Bandwidth Attack On One Of My Clients

One of my clients is under a bandwidth attack in the past few days. He went from 6000 "hits" (file requests, not users) on his site Monday to over 11,400,000 for the day yesterday (Friday). Today's just further escalation.

His site usually does about 2-6 GB traffic a month, and he's now over 450 GB for the month of December as of earlier today (being Dec 6th - 6 days into the month).
The traffic is from (or if using proxies, appears to be from) multiple residential IPs - with over 90 simultaneous users on the site at any given time.

First they were hitting a particular image, and when access to that image was removed, they've just been hitting the home page since.

Besides taking his site offline, any thoughts here on how to keep him online?
I discussed with him moving to his own dedicated 10mbps/unmetered system - but with the escalation here, I'd imagine they'd use up all that bandwidth in short order as well.

Any experience on how long these attacks generally continue? All I can think is that he's hurting a competitor who is now using this as a tactic to cripple the online business/success/etc. This business (for the types of products they sell) for the most part is pretty small though, and I can't imagine one of the competitors really has the knowledge on how to do this themselves - or even coordinate it themselves (or they'd be in another business making more $$$). If they're not coordinating it themselves, any idea on how much it might be costing the competitor to have someone else coordinate such an attack?