So, in order to do damage, you first have to reach the appropriate number of successes to hit the target. So, in that case, if Mr. Rabbit has a DEF of 1, you need at least 1 success, and any additional successes after that equate to damage (for example, if DEF is 1, Successes equal 2, then the base damage is 1) plus the damage from the weapon, which is 2, totalling 2 damage total. If your successes do not meet or beat the DEF of a target, the attack is considered a miss.
Looking at it another way;
Damage = (Successes - Target DEF) + Weapon Damage
or as per the example above
(1 Success - 1 DEF) + 2 = 2 Damage
or (2 Success - 1 DEF) + 2 = 3 Damage
Hopefully that makes sense.
As for the suggestion, it's something to consider. I wanted something that would convince others not to just max one stat, and while they could do that, there would be a downside to it. Options with pros and cons, in other words. But it's something I might change in the future if it's too much of a downside.