[usernamebias]

Hi, apologies for the delay.

The public POST endpoint has strict rate limiting. And user dashboard has custom spam filters options.

Allowing public-key owner time to realize they are getting spammed, and block the IP via dashboard.

If a more complex attack was lunched, such as IP Masking, our API middleware would trigger and deny access based on more complex conditions.