Comment by akennberg

You can add a soft rate limit with a captcha to make sure it's a human doing the requests rather than a spammer's script.