3. Mempool will be overflow if the attacker just send millions of transactions, so there should be a mechanism to remove the transactions from the mempool if they are more than xx hours old
But then the real users and the attackers would and could re-broadcast their unconfirmed transactions to the network. IIRC, by default, bitcoin core will do so every half an hour.
So, I am not sure if this "remove from mempool" helps to counter or reduce the problem.
This could give legitimate users a choice to re-broadcast the transaction with higher fee or wait until another time. For attackers it does not matter since they are going to flood the network anyway
Again there is no universal solution against attacks. Chinese built a great wall, but the general that guarded the gate opened it for the enemy because of a woman

Reject high-frequency transactions from unknown source might be a better solution, but that means each node will be updated with a list for trusted high-frequency transaction entities, thus some kind of management scheme will be setup. Then there will be politics around who should or should not get into that list, will get complicated
Pure market driven solutions will not work due to some people who control large amount of resources will be able to attack for months while majority of users will not be able to compete with a higher fee. 1% of people having 99% of the resource is a fact