When you have a full client it means that everything that is stored on the Blockchain is on your computer. When you call a static function on some contract through web3, for example, there are no outgoing requests, everything is performed on your machine. How does it work when you have a light wallet? As I understand it, when you have a light client there's a special much smaller copy of blockchain on your computer. This copy, I believe, holds only a part of blockchain data. If that's true then how is the rest of the data retrieved when needed? Who is supplying responses to requests? Full nodes? What's stopping the attackers from spamming the network with multiple requests?
First The light client protocol for ethereum is under development. But let's discuss the purpose :
The purpose of the light client protocol is to allow users in low-capacity environments (embedded smart property environments, smartphones, browser extensions, some desktops, etc) to maintain a high-security assurance about the current state of some particular part of the Ethereum state or verify the execution of a transaction
such client doesn't verify everything but instead relies on connecting to a trusted node. It gets only the block headers, in order to exploit the patricia tree for the verification. More details : https://github.com/ethereum/wiki/wiki/Light-client-protocol
concerning the security, there is no DoS protection measure to protect the full nodes, Bitcon has faced this kind of attack from fake SPV wallets. read : https://bitcoin.org/en/developer-guide#potential-spv-weaknesses