Viewing the DNS cache in the Server Manager

Look in your DNS zone and see if there's still a NS record in existence for the old DNS/DC server.

I can't tell you for certain what it is, but I can tell you what it isn't:

1. It isn't a Kaminsky / cache poisoning attack.
   • Kaminsky attacks require a random "nonce" on the front of the queried domain name
   • Your server is authoritative, not caching
2. It's not high enough volume to be a reflection attack against the third party IP addresses

For what it's worth, I think this is misconfiguration of those domains, although from here they appear to be offline. I can see some inconsistencies in the glue records for burningpianos.com - the .com servers say that they're 209.97.196.66 and .67 - is that you?

Contrary to Brad's suggestion, I would say that if possible you should actually configure your server to return a REFUSED response to queries for these domain names.

Simply dropping the queries means that the clients at the other side will continue to retry, as appears to be happening already.

If the traffic drops when you do that, it straight away tells you that the source addresses are not spoofed, and that would reinforce the theory that it's misconfiguration.