Rate limit anonymous, unlimited if you provide an API key.

This way you can identify WHO is doing bad things and disable said API key and/or notify them.