Is there no good way to size-cap and rate-limit anonymous accounts ? Maybe not, if the bad guys slowly build up a large mesh of accounts and use bots that use lots of different IP addresses etc.