We are pushing some changes to rate limiting - this wasn't clear in the original post and I just edited. Thanks for the heads up.
The only reason he got 1000+ emails is because you guys messed up.
Not even going into the whole idea of you releasing that end point with name leakage without somebody going 'oh hey.. do we have rate limiting?'.
Mistakes like this are signs of amateur hour.
Most likely they're implementing rate-limiting to appease people and prevent an ongoing spam issue. Or perhaps it was on their list for a while and just hasn't been an issue until now.
If it's IP based at let's say 10 over X attacker would have to lease 100 IP's.
In any case, rate limiting is the quickest mitigation prior to actual fix of the data leak in question.