What about the part where people used expired credentials to 3rd-party services to create admin accounts?

Scraping may not be a crime but unintended privilege escalation is a whole different story.