A relay know how many users a single relay have, so can whitelist only the "approved" ones (payment powered or connected to other kyc procedures) and those with max 5/10 users (friend and family). If a bot adds 1000 keys to a domain is doomed.