Perhaps to deal with this in the future, you can go down this dark and shady road...
Put a notice on the site that only miners pulling in at least 10MH/sec are welcome.
This will not keep out the cpumining botnet, but it will establish the terms of your pool and the botnet would be violating those terms. Then, once you identify a future botnet, invalidate 2/3 of all shares submitted by miners running less than 10MH/sec and just pretend like they didn't happen. Net result, the rest of us benefit from the work of the botnet and the impact to the botnet's profitability might be low enough that they don't even notice.
and what about the Legit users under 10 mh a sec? oh right 'they are not important'. how could i forget..
They are not worth... probably they cause more problems (bandwidth/resources consumption) than their benefits (Mhash/sec).
So I think it's a good idea that larger pools allow only "gpu" users meanwhile "cpu" users must be confined to smaller polls where they are welcome.
My 2 cents
I would tend to agree with you, under 10 MH/sec likely clog the servers in terms of getting idles and it is doubtful that at this difficulty many people are knowingly CPU mining outside of thoes with free electricity.
On another note, cautiously optomisitc the servers are coming back up? My miners have swapped off their backup back to BTCGuild and I see the pool at nearly 100GH/Sec now.