When Missing Rate Limiting Leads to a Critical Authentication Finding: A Real-World Case Study