I recently ran a Minecraft event with 50 players, all in the same physical space with a shared internet connection. About 2/3 of players were challenged for their authentication credentials, and after entering known good email addresses and passwords that had all previously worked, login was denied with an error indicating invalid credentials.
I was able to reset the passwords on these accounts, but even after resetting the passwords they still did not work.
The strangest thing was that the newly reset passwords would not even work when trying to log in via https://accounts.mojang.com/login -- I would reset a password, get the green confirmation message that the new password was successfully set, and then when I tried logging in again via the web site it would not accept it.
Switching over to an internet connection via a cell phone resulted in everything working. We tried to fool the system by logging in over a cell connection, and then switching the network back, and that worked for a few accounts but then we started getting "invalid token" errors after switching networks.
Then after a couple hours, everything worked again.
To me this points to a temporary throttling or blacklist of the network's IP address.
Since everything worked fine before and after the event, I tend to believe it is not a problem with the firewall or network configuration on our side of things.
Is this a known practice used by Mojang?
What triggers it?
Is there a way to proactively avoid it by getting an IP address whitelisted?
Why don't they provide any actionable information when they are doing this, and why would they permit a password to be reset but not used?