Not just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped). Additionally,

Not just rate limiting logins, but rate limiting queries against their user base (10k logins compromised, and data on ~6 million people scraped). Additionally, they don't support 2FA/MFA which of course would mitigate some of the risk of password re-use. There's plenty of things they could have done to prevent this breach.