Yup, I couldn't find the details, but IIRC it was a combination of people generating new accounts in the hope of catching a second round, and the fact some people had signups for Keybase auth on only one or two systems, and also IIRC even if your Keybase account pre-dated the cutoff date, you needed three associated auth systems configured in order to qualify for the coin drop. So there was a huge surge in signups for Github & Hacker News to tick that box. Doubtless some surge was related to people hoping to get in on a (speculative) second drop date.
Edit: Ah, I see, people tried to find dormant HN and GitHub accounts. https://www.coindesk.com/stellar-tried-to-give-away-2b-xlm-t...