In general when you are spoofed with a legitimate IP Address, in your case your friend, what you can do is an analysis of the IP TTL values and try to see if your defense system allows you to put ACL, or rules that allows operations on TTLs such as <>= certain value. If this is not working probably you will need to go to rate limiting solutions.
The best thing you can do is to save these captures you did and send it to ISP of the attacker, asking to take measures.
You can do nothing at your end to stop the attacker (without making a big DDoS-protection solution).
As long as the ISP allows the attacker to spoof his source addresses, the attack can continue.
The thing you should check before sending ...
First you should look into the reason why the attacker has your friend's IP in the first place.
Ask your friend to change the IP, and make sure he is not leaking it again. Or ask him to use a VPN when he connects to your game server, and use that VPN for nothing else. In case the attacker has access to a website (e.g. a clan website) that your friend uses ...
Depends on the attack you want to generate(Attack type), the capacity of your single host (CPU, Memory), and on the network capacity (Bandwidth), and also on the application that is receiving the requests in the case is a L7 attack, and probably more variables to take into consideration.
Can we make password cracking so difficult that even if he has the hashed password, he will not get a major advantage over testing the passwords against the server - even if he has specialized ASICs?
The problem with the way you've formulated the question here is you haven't given us any concrete criterion as to what advantages count as "...