This rate limiting should be done per user and also by IP. Maybe use [this](https://github.com/ExHammer/hammer)?