We actually have a public self-serve API. In some cases, if I've tried the diplomatic approach, I've had to actually shut off API access to get someone to even respond to me.
In this case, it appears they've taken the same access/creds as the mobile app maybe?
Another one of our platforms we cert-pinned the API to prevent this as well.
Yes there are ways, the other part we don't know is if they went straight to the legal route or not.