The sad fact is that you invested in some "DDoS protection", you lost money while your opponent lost nothing. There are no DDoS protection on this green earth. Want to take down CIA/FBI site? Just use a massive DDoS. It will work for a brief moment.
Using CloudFlare, or a configured ClearOS will do the job quite nicely.
Or, if he is just a fool, blocking the IP address will do the job also.
Why you don't just DDoS him back? It's a better solution. Even if his Google Adsense account is banned, for that amount of traffic he will probaby only lose $100. Check with your hosting, maybe they are in league with your"enemy" to make you pay for the "so-called" DDoS protection.