[bluesign]

This should be textbook description of brute force.

This is no different than SSH into some machine and try password combinations, or try to login someones email with bruteforce.

Although rate limiting etc is necessary, I think brute forcing someones email account should be illegal.