In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server as soon as they're detected.
I know though, that if the attacker is going after more than just your runescape account, you probably shouldn't take down your entire server. If you're a hospital, I doubt you would want to cut off life support to save some dude's medical records. In this case, I would guess you could just boot your attacker off. If there are multiple though, or the attacker somehow protects himself from this, is a "head to head" a real thing? Could an attacker actually protect themselves from this?
I'm sure there's an "automated" defense, like just some program trying to boot them off, but would there be any case where a human would actually have to type things in to prevent damage?