You totally did the right thing in turning on under attack mode – even if it's not a full-on DDoS, this sort of scraping can actually bring the DB to its knees. Maybe block some dodgy user agents or add some rate limiting rules? Stops them dead in their tracks short-term.

Had a similar issue on another board – a weird bot caused chaos but didn't set off normal alarms. Cloudflare was a lifesaver, though some genuine users complained. Thanks for acting so fast, the site's okay again!