It seems possible, but it also seems like a sorta painful problem to solve if locking an account requires dredging through 3+ months of a user's interactions.

It seems possible, but it also seems like a sorta painful problem to solve if locking an account requires dredging through 3+ months of a user's interactions. At a lot of companies that kind of historical data ends up getting batched and stored in some kind of timeseries datastore (aka S3) and then batch-operated on via Spark, MapReduce, Flink etc in hourly or daily jobs. So instead of implementing account locking and scraping detection at the realtime layer looking at current requests, you have to write some ugly daily aggregate & backfill job, which inevitably ends up super expensive and slow. Anyway, yes, but I can definitely sympathize with _not_ doing it this way.