Add sensible rate-limits (modelled after an average user's expected usage) and present a captcha after that. Make it per-IP. Sure, the crawler can change IPs,

Add sensible rate-limits (modelled after an average user's expected usage) and present a captcha after that. Make it per-IP. Sure, the crawler can change IPs, but I doubt they have unlimited addresses and eventually they will run out. Another option (if you can reliably detect the scraper) is to poison their data by sending them bad (but valid-looking) data.