Thank you for the detailed explanation! In our case, it definitely was an automated attack. The orders did generate a Failed status, see linked screenshot. There were several hundred orders but I deleted all but a few for reference. Not sure if this helps you out anymore with my dilemma. Thanks again!
https://snipboard.io/ZjHktd.jpg
