Ajax: Someone Putting In 100 of Orders Through Ajax At Once?

[Misser]

We had an issue earlier, but got it fixed. We setup cloudflare and put a few other security measurements in place. However, somehow someone came into our site and placed a ton of orders using stole credit cards luckily they all got declined. But if you look at the time in the picture below. They were all done at the same time. There were almost 800 of these that came in. How was they able to do this through AJAX? Is something setup wrong?