> the problem is that it hurts legit people too.

What hurts other people too?

Measures to stop "distillation", rate limiting, ID verification, etc. If there were such a method that didn't harm legitimate use it would already be in place (and some things are, but they don't really work, hence the OP).