Did Uber try to obscure what they were doing by spreading the requests over various IPs to cover their tracks? This would indicate that they knew they were doing something malicious (which could affect sentencing if this is considered a federal crime under US law which it actually might be -- though IANAL).
If this really was "realtime", why didn't Lyft notice the unusual request volume? What could they have done to detect this as suspicious and investigate? Are there some specific lessons other companies could learn from this?
An app that did try to stop this type of behavior was Pokémon Go. It took them a while to do even halfway well.