I just checked my Cloudflare account and assuming it hasn't changed too much since they set it up, on the API key creation page one is offered a number of commo

I just checked my Cloudflare account and assuming it hasn't changed too much since they set it up, on the API key creation page one is offered a number of common permissions setups none of which allow this type of attack. I believe this is sufficient evidence that the API key wasn't considered safe to distribute even internally around the company.