> If I wanted to use this for malicious intent, then I think the most valuable thing I could get away with would be a 5% discount coupon

Or spinning up hundreds of accounts on a website so you can perform card testing. Or creating accounts so you can put all of the inventory for an e-commerce site into carts to reserve it for yourself. Or running sneakerbots. Or any other malicious intent where the victim is the website operator.