Also, the attacker code need only to achieve a limited success rate (eg: ~10%). Think of a gmail account creator: 1000 requests * success_rate = 10 accounts per

Also, the attacker code need only to achieve a limited success rate (eg: ~10%). Think of a gmail account creator: 1000 requests * success_rate = 10 accounts per minute. Not bat at all.