There is an inherent tension between rate limiting and normal user experience; advanced defense systems typically keep loose limits for ordinary users and apply progressive restrictions (soft throttling) to accounts detected with anomalous patterns.