To be clear, we signed a contract that explicitly prevented this API to be used for anything other than our particular commercial use case and access to production creds to this service was heavily restricted. I never once saw the service being abused, but you're absolutely right. The question I kept asking myself was: who is out there using this service against the vendor's TOS for whatever reason? This industry was largely built and shaped by people that didn't care at all about the rules, and the longer I work in this field, the more cynical I become about the effectiveness of just adding more rules. It feels like a pinky promise at this point.