So why are you blowing this off and now all of a sudden writing rate limiting?

The only reason he got 1000+ emails is because you guys messed up.

Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'.

Mistakes like this are signs of amateur hour.

Suppose they limit it to 100 emails before blocking your account. The guy can just sign up with 10 accounts. Or 5. This "attacker" would still post it and make a big fuss.

Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.

In regards to rate limiting, it would be a much smaller number prior to block.

If it's IP based at let's say 10 over X attacker would have to lease 100 IP's.

In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.