As of the current time, I don’t really have more information than that. I thought they were spamming events in order to lag the server and then ultimately crash it.
I believe @ConvexHero recently released an update that prevents the abuse of spamming remote events, although it still has to be optimized to prevent false positives. You can read more about it here.
However, you can still create an anti-abuse system on your own too. Perhaps kicks and ban anyone who fires an excessive amount of remote events in a second.
This blob of code I reverse engineered from some obfuscated script used to instantly crash a server. I don’t know if it still behaves that way though. You can test it by running a local server and pasting the script into the command bar of one of the clients.