For now I use a token based rate limiter that limits the number of requests an IP address makes to prevent this see plenty of clients rate limited. No idea how to translate this into a NIP yet though 🤔