Sympathy for the SEC on this one. For its faults, EDGAR is an elegant, useful tool for disseminating a massive amount of information. In an effort to be robust in the service of its presumably thousands of poorly-configured clients (academia, hobbyists, day traders, etc.) it's probably trivial to mistake a hostile act for poor programming practices. We've used this system successfully to fuel tons of projects and only on a few occasions been rate-limited despite numerous logic breakdowns, fork bombs, etc. resulting in traffic spikes that would have been easily mistaken by a smaller organization to be DoS attacks. While it's easy to say they should have been more vigilant, they have probably been deliberately permissive in the service of their mandate. Thanks to their patience, our projects have been served. That sort of patience probably leads to overlooking something like this.