If you are asking if you could theoretically DDOS a site by requesting that information for each user, then the answer is, it depends. There are ratelimits setup by default in Discourse, however, if you tweaked those or are bypassing them, then well, you’re on your own. 