- The website just acknowledging that 'somebody' already made the request?
- The website recognising both requests were TOR users?
- The website somehow identifying me as me despite TOR (presumably by some JS exploit)
If it's #3 then it must be pretty easy to identify TOR users who have JS enabled, no? Because it was just a random website not one inhabited by black-hat hackers or spooks. well, i assume not lol.