If I was someone who would look into systems for less-than-usual purposes, I would start looking at those data-collection apis and processing pipeline, I bet there's a lot of shallow validations and lack of limits

It would be fun to see how many phone numbers would fb be happy to import as an example.