[jefftk]

In this case, if NPM has any mitigations like that, they would not have been triggered, because the reporter stopped once they had full access to the account.