> The inconvenience to the deactivated account is minor: one SMS verification code and the account is back, queued messages get received, etc.
Unless I spin up simple automation to deactivate your account every hour.
Unless I spin up simple automation to deactivate your account every hour.
On top of that, if a specific account is targeted at the rate-limit, a flag could be put in place to let support disable the automation for that account.
If we're talking about deactivating someone's account via email, we are already talking about a targeted attack.