mailq's comment isn't so much anarchist as it is the Right Answer for Most Cases.
If users are using corporate (or school, etc) resources to perform illegal activity (whether it is on the Internet or not), appropriate measures should be taken to let them know that this is completely unacceptable.
Nobody should be anonymous on your network, you should be able to easily track it down to a specific computer (DHCP lease) and most likely a specific user.
Given all that, The Spiderlabs Blog has an article on snort rules to detect LOIC activity. Implementing snort may be your best option if you really can't address the problem through education or a LART.
Ben's comment brings up a whole 'nother can of worms. Consider:
- Does this expose the network owner to liability if illegal activities are conducted?
- How open do things really need to be? Can you open HTTP/HTTPS-only? Can you rate-limit?
- On a large network (such as a hospital) you may be better off with a commercial hardware IDS/firewall.