Those botnets are hitting random endpoints thousands of times a minute.
The problem is that each time they switch to a different residential IP so that they are untraceable.
That's the frustrating part: not only do they not play by the rules, but they use advanced methods to obfuscate and bypass any protections. That probably costs them a fair amount too, all that to access free data they can download as a tar file...
They won't be able to create thousands of API keys a minute, and if they reuse the keys they'll very easily be identified and blocked.
Artist similarity is calculated from the listening history of all users.
Basically if many people listen to artist X and artist Y within a short window of time, that counts towards their similarity score.
Also artists that appear together on compilation albums also counts for similarity, but to a lesser degree.
In the near future we want to add more data from MusicBrainz, for an easy example band members being part of other bands = they are probably similar.
All of this is available on ListenBrainz, but will most likely not be surfaced on the MusicBrainz pages which have a different —more factual— focus.
I also want to add that MetaBrainz (the non-profit foundation that MusicBrainz and Picard are the base of) also have ListenBrainz, a music discovery platform that we built because of similar discontent over the way recommendations were going.
Also has the advantage of being free and open-source !
(I work with MetaBrainz)