734
Authy got hacked, and 33 million user phone numbers were stolen
(appleinsider.com)
This is a most excellent place for technology news and articles.
They absolutely exploited unintended functionality. If this was intended, they wouldn't have added rate limiting and locked down the api after. It was clear to say this was certainly not an intended use of the api.
In a video game for example, if there is a an item that caused excessive lagging just by placing the item. Placing a lot of them with the intent to lag the game would be an exploit. They only used items sanctioned by the game, but for unintended reasons and they would likely be banned for exploitation.