Bravo to the people that can navigate such a complex (not an insult) architecture and pull useful information from it! I expect it to be quite tricky to get in between the production environment(s) and capture packets or change logging etc.
I did wonder though: the authors seemed a bit unsure about the relation between MaxStartups and resource usage, wouldn't it be wise to just send an email to the openSSH mailing list or something to not be surprised by possible future problems?
Might be valuable if it reacted the same way in all environments (not always the case). And if someone answered faster (correctly - without sending them down an unrelated rabbit hole too!) then they could have found the answer out by just experimenting.
Don't get me wrong - I'm a huge fan of community support, but sometimes it's faster to just try things and see how the systems reacts.
Not to say you can't do both in parallel; and they might have - you aren't going to detail everything you did in a writeup like this.
As others said, I really enjoy reading write-ups like these. Who needs fiction when you have real world mysteries to solve?
I did wonder though: the authors seemed a bit unsure about the relation between MaxStartups and resource usage, wouldn't it be wise to just send an email to the openSSH mailing list or something to not be surprised by possible future problems?