If you really want to go hog wild, you could use a system where tokens with a short expiry are used to authenticate requests even when users aren't logged in. Y

If you really want to go hog wild, you could use a system where tokens with a short expiry are used to authenticate requests even when users aren't logged in. You'd combine that with rate limits + IP-level bans for when active or expired tokens are overused. I would say that's total overkill for 99% of services though.