It turned out I remembered the number incorrectly. It was actually 5000 http requests!

https://news.ycombinator.com/item?id=42726827

However, upon further investigation, this is a special case triggered by a security researcher, and not the normal mode of operation.

If one reads the security advisory - the security researcher’s claim is that a particular API endpoint would accept URLs without deduping, so they were able to send 5000 URLs to it - nothing more sophisticated.