They claimed 9 pps from 16 source IPs was enough to bring a system to its knees. So that eliminates the possibility of brute forcing the cookie.

I'm not saying this isn't just naptha with some client-side caching to make it less resource intensive to the attacker, but it's not as you described it.