Chuckle silently to yourself and wait. It is an angry user and it happens. Occasionally, you'll get lucky and find that someone can follow through on their threat. In that case you do the only thing you can - wait it out. It happens and unless you depend on your service being online 24x7x365, a little downtime isn't going to hurt. If you do depend on that type of up time, you're going to end up paying for technical solutions.
There are technical things that can be done, but they generally involve spending money with your hosting provider. One thing one of my hosts does, to protect themselves, is null route an IP if it sees a massive spike in traffic. This stays in place for 8 hours. It's unfortunate if your service isn't available for that time, but one thing I've noticed since switching to this host is that after 8 hours I've yet to see an attack still on going. The other nice benefit to this null route is I'm not on the hook for this excessive traffic, because it's being stopped at the data center border routers.
To the attacker, it looks like they've won. Hooray! Server is down. Might as well stop this attack now. When they check again in a few hours to see what people are saying about the down time, they notice you are still down. A few hours later, still. Wow. I won. Their ego is inflated and they move on. Obviously this type of defense is fine for a small community. Eight hours of down time isn't going to hurt any thing.
Another, technical, option is getting more bandwidth. A fatter internet hose means it's going to take a larger attack to affect you. After this point you probably need a dedicated person/team to support a denial of service mitigation plan.