DDOS server when not making direct purchase. If there is a financial incentive the process is automated to generate maximum value for the scalper. In our modern age scalpers are not going to be waiting.
Biggest impediment would be changes to purchase process. Run one live user through and repeat for how many bots you want to buy more.
Agreed with your comment on random being better. I just found a scalper sitting at a PC for 20 minutes waiting to buy pretty funny.
I expect Steam is already being DDOS'd probably close to 24/7. DDOS services are cheap, and there's plenty of kids with a card that think they're going to show off their 1334 haxing skillz after getting banned for using an aimbot they also paid for.
They are not exactly great in handling large peaks of traffic. They don't last that long, but they are still there. Controller launch had order processing issues. Any large sale start always have issues. Though it might be less load and more of making tens of thousands of background changes on items on sale.