This is just a run-of-the-mill DoS attack, with the astronomically unlikely jackpot of additionally invaliding a random unknown user's API key when you get a hit.
Cracking hashing requires large parallel processing, something you can't do if you're API limited