Rate limits are easy to automate around. CAPTCHA's are apparently terrible UX.
How do I prevent automated spam and abuse?