If you make some search you'll find old blog post that fast spreading of Cloudflare so called "spam protection" is not some random stuff.
Now Cloudflare is used to block users of national level, and frequently such option is very fuzzy or turned up automatically. So admin don't even know that it is on. On shared or VPS hosting such "protection" can be even automatically on and admin don't know that it exist at all.
I am 99% sure that all major spam attacks had been performed by Cloudflare and related firms by itself to gain clients, and, more importantly, to gain censorship right.
It looks like you're new here. If you want to get involved, click one of these buttons!