We have had the same problem with Microsoft where our marketing department is effectively DDoSing our service by sending out links to 50k+ users.
We would get spikes of thousands of requests per second from Microsoft IP addresses, which after some googling were linked to their threat detection.