Me too, I think he's using a backdoor to Instagram, somehow he got unfirewalled IP. where he can get responses from Instagram due their updating system. I agree with you %100.
Because I've been using the following with failed attempts:
1: login then comment using their Public API. "Got blocked after 200 comments requests".
2: login then comment using Android private Instagram API . "Got blocked after 15 comments requests".
3: login then comment using 3rd party apps such as Hootsuite, AgoraPulse, Sprout Social, still getting blocked.
4: login then comment using Cookies, and using residential botnet IPs. still the same..
I am pretty sure he got a vulnerability. am still digging.