It sounds like your host has some sort of anti-DOS configuration setup and your customer is triggering it by opening many tabs simultaneously. I'm not surprised if a single tab accessing your system is opening several simultaneous HTTP sessions to download files in parallel - so if your customer has 10 tabs opening at once, as newer browsers offer to do, then it's not surprising to hear that your customer is opening 10 x several HTTP sessions to your server.
IE 8 opens up to 6 concurrent sessions to the same hostname.
If you have several hostnames set up as CNAMEs pointing to the same IP (some people like to set up, say, "images.example.com", "css.example.com" and "forums.example.com", all pointing to the same actual host), you may be making the problem worse by making it hard for IE to see that they are all the same machine - apparently the comparison is done by host NAME, not IP.
Your customer could probably reduce the likelihood of this occurring by using a different browser, using a local cache, modifying his IE installation to use fewer simultaneous sessions, or by not loading so many tabs at once.
You could ask your host to increase the number of allowable connections to your webserver, shrink the time window for detecting overusage, or whitelist your customer(s) if your customer(s) use predictable IP addresses.
If your host's firewall is excluding based upon the number of simultaneous open connections, you might be able to improve the situation by making sure your configuration is optimized - e.g., minimizing unnecessary queries, looking at caching with varnish or some other sort of accelerator, turning on compression, making sure you're allowing HTTP persistent connections.
This sounds like a tough problem to solve if you can't control the system making the connections or the system limiting the connections.