I think I was part of a model distillation attack (sebastianmarines.com)

sounds more like a pirated api key sold to someone in china and the first one is the buyer and the rest are either a single entity or some pirated open router service.

I do not think distallation works like this; could be wrong though.