Sure, a lot of countermeasures is possible. I will definitely consider it next time, but for this calendar which had sitted unused for years on this instance, i decided to just turn off the plugin. A random wordpress plugin is never only a DoS avenue but also a bunch of potential vulns.

Thanks for the suggestions!