We're a totally unknown site that just got hit with an OTP attack. There was minimal damage for us as it just ate through our Twilio credit. My question is why do people do this? What's in it for them?