I’m also surprised that one of these threat-detection things people talk about wasn’t triggered when he was literally sending with “123456789” in most of the fields of a request.

Considering their systems allowed data return just because they got asked repeatedly, I’m not surprised at all. You’d be surprised the seemingly important metrics that don’t get monitored and reported on during day to day operations.