A spike in applications in the middle of the night, when most people would usually be sleeping, was a red flag.