The easiest win I've come across is adding a CAPTCHA when requests exceed a certain threshold. Yes, CAPTCHAs suck, but this way 99.9% of users don't have to dea

The easiest win I've come across is adding a CAPTCHA when requests exceed a certain threshold. Yes, CAPTCHAs suck, but this way 99.9% of users don't have to deal with one.