The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.