If attackers can’t get a valid account, then they can’t make requests and consume lots of resources, so in turn can’t disrupt ...