Continuous Attack ... Let the server attack for you once every 1-2 seconds and send the results to the client. Server just keeps processing the same attack message until NPC is killed or you tell it to stop. For shared elites/bosses could also end when you've done enough damage to trigger the lock.

It would be a trade-off. Not quite as fast as spam-clicking attack yourself, but should simulate it close enough. While it will use some additional resources (timers, storing message), it will not hammer the server with attack messages any worse than manually clicking the attack button would. Should not down an NPC faster than doing it manually. Taking just a bit longer than manual means that using it would be a convenience, and you won't go through NPCs as fast (but still fast enough).

Unless the server checks the time between attacks, putting the timer client-side would open it up to someone modifying the client to spam the attack faster than intended (you know someone will have to try). And if the server is going to check anyway, then why not just keep the functionality server-side. Much, of course, would depend on how the server is designed/setup to do things (which only Dan and company should know anything about).