Why couldn't they block you then? They should have been able to quickly disable the accounts.

Our product was built for end users, so the traffic coming from our servers could technically be from any account. But as to why we weren't blocked during testing, that I'm not sure about. It's been about 8 years since I did that work - I assume we had someone's account who wasn't obviously connected to the company.

Sounds like a version of Plaid lol

Yep it was very similar, just with more of a focus on retail trading.