They can, but usually don’t. I’ve heard of systems being vulnerable to attack when resource usage is completely maximized. They can definitely cover up an intrusion or test a botnet, though, and I suspect this was a botnet test. Mastodon users overwhelmingly strike me as not worth unmasking. (And that’s a good thing)