Simplest approach would be to require solving a captcha for IPs that perform actions with a high frequency.