You do have an obligation because what you are describing is illegal, at least in the US under the CFAA.
Okay, nix the zip bombs. What's my obligation to treat bot-shaped traffic as something I should reply to?
alt Hacker News
Okay, nix the zip bombs. What's my obligation to treat bot-shaped traffic as something I should reply to?