[cldellow]

I would believe that scraping is why they now require users to be authenticated.

But given that they now require users to be logged in, it should be computationally cheap to drop unauthenticated requests at the front door before they incur real expense.

It'd also be cheap to just blackhole datacentre IP space.

The sort of attack that would require this level of limits is malware on tens of thousands of residential machines that can use a user's existing Twitter session cookies. I'm really skeptical that's the case.