We can’t be sure but this seems more likely about signup spam that we discussed here: Observations about spam signups
Are you able to see access logs coming to your /members/api/send-magic-link/ path? Then check if you have some repeating IPs there and if they are coming from Tor network (GitHub - okinjp/tor_ips: Tor Exit node IP addresses (Generate from metrics.torproject.org)) If so welcome to the club. The solution we could find until now is blocking Tor Network for send magic link endpoint.