In my app, users can create projects, and invite other users to their projects. The invite email contains the project's name. You can guess what happened next :

In my app, users can create projects, and invite other users to their projects. The invite email contains the project's name. You can guess what happened next :-) The spammer must have been quite determined -- for free accounts there is a limit of invited users, so their automation script had to send an invite, cancel the invite, send the next invite, cancel, and so on. Fixed by adding more rate limits.