Yeah, I think your suggested mitigations sound reasonable. Everything in this space is going to be only partial mitigations, but it should still be discussed, especially if "secure" is a selling point and given that the FaunaDB service is billed based on usage.

What I would do:

- one-time use token for the creation form, a la CSRF tokens and nonces; Although that just doubles the number of requests needed to perform a submission

- rate-limit all endpoints based on IP, user agent, etc

- Captcha on creation form