>The actors I've seen taking advantage of it are highly unlikely to front up with a credit card and provide what amounts to personally identifiable data (i.e. make a credit card payment) in order to mass enumerate the API.
Unless they just steal a credit card. Not unlikely, given who we're talking about here.
Unless they just steal a credit card. Not unlikely, given who we're talking about here.