In regards to rate limiting, it would be a much smaller number prior to block.
If it's IP based at let's say 10 over X attacker would have to lease 100 IP's.
In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.
Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.