Hacker News Reader

Curious what kind of logs/analytics would you add and watch to catch something like this?

You should notice a spike in any request logging metric if someone exploits this.

Depends on the normal usage, if someone was doing this across unique ips and slow enough that the usage change may be say 1% it wouldn't be noticed.

A more sophisticated system that could look at the ips in use and compare to previously used ips for the accounts would notice something.