There are probably a baseline of real security alerts for 3rd party credentials per day. For any given user, hers may have been from this bug or it may have bee

There are probably a baseline of real security alerts for 3rd party credentials per day. For any given user, hers may have been from this bug or it may have been a real attack. If normally there are 200 alerts per day but while this bug was present there were 20k per day, then any given message was likely to have been from the bug, but some were probably real.