Maybe it's a way to test the attacker's infrastructure against a semi-hardened target?

I say "semi" because it still seems like a small-ish player, and while I do trust PM to have some very capable people handling their infrastructure, I doubt they have tens of millions in their security budget (vs e.g. Cloudflare or Google or perhaps certain banks).

If you want someone to not get email for a few hours.