I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts. It might be instead t

I would hope that Instagram has some counter-measures to prevent brute-forcing, at least restricting the number of failed login attempts. It might be instead that your friends re-used a password that was leaked/stolen from somewhere else; anyone with a non-trivial number of online accounts using the same email will be listed in multiple leaks on aggregators like https://haveibeenpwned.com/ https://haveibeenpwned.com/.