The vulnerability stemmed from missing IP-based rate limiting on public authentication endpoints. The commit added 'throttle:public' middleware to these routes, and introduced random delays in password reset handling. The affected functions correspond to endpoints that: 1) Processed user-controlled input (emails) without request limits, enabling user enumeration via timing analysis or response differentiation 2) Allowed unlimited attempts to trigger email notifications, creating a DoS vector. The high confidence comes from explicit patch evidence showing these functions were secured with throttling and timing mitigations.