Well, there are degrees of criminality, which is why penalties for certain similar acts vary depending on the exact circumstances, methods, and intentions; e.g., manslaughter vs. 2nd degree murder vs. 1st degree murder.

I think this was the point. DDoS attacks potentially affect innocent people who just want to (say for instance) buy some cheap Viagra and who have nothing to do with the spammer who caused the initial irritation by sending yet another useless email.