Thanks for the details. With all those limits, the only way to try to DDOS steem on-chain is to have a large amount SP, right?
So you have a bunch of limits on-chain. My second concern was that before those limits kick in, you still need to receive and process them. Did you test the steemd/the api can sustain a bigger load or do you assume there is no need? I mean it as someone sending the same tx again and again, that will be blocked by the blockchain when it gets there or more active users commenting live the world cup final.