But they just guessed two of them right?

There's a possibility that someone was dumb and is actually using a seed with a simple repeating spurred or phrase, like "bacon" repeated 12 times results in a valid seed with checksum. I've actually thought of looking for one...

Probably there are script that run every minute checking this sort of obvious seeds, ready to wipe them