The part I don't understand is how the excess traffic not triggered alarms on the hugging face side, or the url shorteners used, or on anything that was touched in the process.

Nothing got overloaded, no unexpected CPU or IO use? Did it blend into the normal traffic somehow?