I see that you have a timer, did you have it when you was attacked? Did you check traffic? Maybe they were real users. Login in cpanel and check logs
I do have a timer when my faucet was under attack but they cant be real users (maybe) because they're all claimed at the same time.
Coinmedia.co shows that my website have a total visit of ~3000 and 28 clicks in 5 days.
Am I be able to post btc address that has been claiming at my faucet here?