If scratch team dealt with this they’d disable accounts
if anyone notices that around 4 hours worth of data is missing, then you’re right. i had to restore a stale backup of the database because i didn’t want to deal with cleaning up a spam attack (140 individual accounts)
sorry about that.