A couple days ago this person spammed our EC2 server with requests to make a ton of accounts.

It sounds like the workload on the EC2 has increased, consider uplifting to a more powerful instance type https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html

You could also look at horizontally-scaling the EC2 component behind a load balancer, so that as the workload increases extra EC2 instances are provisioned to handle it https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-load-balancer.html and https://docs.aws.amazon.com/autoscaling/ec2/userguide/tutorial-ec2-auto-scaling-load-balancer.html

If the only change over the last few days has been these new accounts bring created, is there a backup or snapshot you could roll back to?

I'm not sure whether this is considered a DDoS attack - you will know better than me whether what this party did was out-of-line - but you could look at tools like Shield or WAF https://docs.aws.amazon.com/waf/latest/developerguide/ddos-responding.html