They could limit requests by IP without storing them explicitly. They could use something like a count-min sketch to store how many requests a certain IP has e

They could limit requests by IP without storing them explicitly. They could use something like a count-min sketch to store how many requests a certain IP has executed, and clean the sketch every minute, for example. The limit would not be exact, though.