when connecting as secondary the sudden jump in upload speed without a file being transferred is your client uploading your list of shared files to the primary... thats the 'file-less' bandwidth surge... if the primary you connected to drops due to the attack traffic mx will search for another causing another surge and you to loose all the queued files both for up and download...
when connected as primary ofc you will be inundated by the attack traffic itself....
basically... in its current state... winmx is a p2p best left to the background if you arent chatting... queue up some files you want.. leave mx running... then 'sleep on it' to see if you get them....
if you were having problems with your isp it should be noticeable in the traffic of other applications....
also dont forget that since search doesnt work an empty queue isnt a bad thing persay just a result of the attacks...