What happened between the 19th and the 28th? https://news.ycombinator.com/item?id=6638004

  Hi Justin. To clarify, from what I understand, October 28
  is the date MongoHQ detected this. They've provided us 
  with the logs of database access, and unfortunately the 
  queries leading to our spam attack on Saturday started as 
  early as October 19.