Looks like the app wasn't developed with a scalable architecture from the start, then they strapped some caching out of desperation when users started flocking, and didn't consider the invalidation parameters for private pages correctly.