To check if it is what I thought. I created a new account and got new token
Next, I tried to bruteforce last 4 digits hoping new account is created in last 60 mins.
I also edit the request to /api/admin/users which requires admin token to get 200 response.