I doubt it's currently illegal, but I don't think it's impossible to make it illegal. Accessing the API enough to prove a flaw and report it is one thing. Getting 17 million PII records over the space of 60 days is orders of magnitude beyond that.

Especially given that things like GDPR and and the CCPA are drawing clear boundaries around private data and how companies can use it, it shouldn't be impossible to make laws that regulate how third parties access and use that data.

I'd also hope that Twitter faces regulatory penalties and perhaps civil liability depending on the harm done.

This should be textbook description of brute force.

This is no different than SSH into some machine and try password combinations, or try to login someones email with bruteforce.

Although rate limiting etc is necessary, I think brute forcing someones email account should be illegal.