Actually the only rate limiting setting I see is a total events per second setting. Doesn't look like there's an option in config.toml to rate limit per npub. I'm going to open an issue on Github about it because that's going to be an important spam tool that shouldn't be too difficult to implement.