"The system you propose doesn't work: either you don't lock anyone out, or you lock out a similar percentage of legitimate users and spammers" How so? Requests

"The system you propose doesn't work: either you don't lock anyone out, or you lock out a similar percentage of legitimate users and spammers" How so? Requests are piled in a queue, waiting for the mutex. If the request can't be completed for a given timeout (Say, 3 times the delay), you'll respond with an error message and the client will retry his request. You could automate the retry, so the user will only experience that it takes time - not a failure. The biggest problem I see here is that it's a clear DoS attack vector.