[yifanl]

You can rather easily set up semi-hard rate limiting with a proof of work scheme. Will very trivially affect human users, while bot spammers have to eat up the cost of a million hash reversions per hour or whatever.

[dartos]

Yep. That works well enough for password hashing algorithms to deter brute force attackers.

This is a similar situation.

[skoocda]

e.g. HashCash