I have rate limited the search engine bots and also banned Baidu's bots as they kept visiting from many different IPs and creating lots and lots of sessions too.
Not related to the attachments, that's just the permissions I messed up.
I think it's just the number of visitors we get. A lot of them are filling up the admin log with ban reports from Beehive's StopForumSpam integration, but that is cached for 24 hours so shouldn't be a problem. Maybe.