For example -- let's say you offer $100 in free AWS credits by signing up to your platform. Expect a malicious user to eventually come to your platform, realize they can resell those $100 in credits for $50, and start using your platform for their own gain. Unless the mechanisms you add in place to reduce fraud / second sign ups / etc is greater than the value that they are receiving ($50), they will continue.

With sites where the platform is free, the math almost always makes sense for these malicious users to eventually abuse. In this case it was leveraging the email reputation of another domain at no cost to their own (along with the added value of anyone getting phished), but on other sites it's public profiles being used for backlinks / spam, etc.

You learn to not leave anything open to spammers AT ALL, to your product's detriment because once you're labeled a spammer in this way your product is dead.

I have a few small projects that I would love to serve publicly from my VPS. But I have put them behind strict logins (no signup) or put them in read-only mode, with (likely premature) rate limiting, fail2ban and cloudflare, for fear that a month of bandwidth gets used within minutes by an attacker. For the same reason, sometimes I only shared the source on github and let people deploy it themselves if they are interested.

1. You are not alone, this happens at a large scale across the board with companies of all sizes.

2. More than likely the abuser did not do it manually, more than likely they automated it

3. As a thoughtful business one may have rolled out all the authentication features/gates if the business picks up, as a starter the safe idea could have been to put it behind any openly available OAuth provider

Exactly. These days attackers mostly exploit application design (not just the code), and preventing that is what security in the 21st century is really about.

Captcha here only harms the real user experience and usually doesn't protect against this kind of abuse, since it comes from real scammers, not fully automated bots.

I'd suggest taking a look at our open-source security framework (1), installing it on your demo, and observing the pattern behind your scammers before taking any further steps.

1. https://github.com/tirrenotechnologies/tirreno

I designed something that was "too open," and that "openness" was abused.

Sadly, spammers are why we can't have nice things; but that's been the case for decades. The incident I mentioned, happened in the 1990s.

The good news is, is that once this happens to you, you learn your lesson.

The 14000 sends over 3 hours (< 1/s) makes it sound more-than-human speed. E.g. automated.

Wondering if LLM-assisted vulnerability hunting will lead to the same gains in scale for bad actors wanting to find spammable channels in applications. The barrier to entry becomes so much greater because any small project, once found, can be wrung dry of all its trust signals by third parties