That's not ssh's fault; you can pipe /dev/random into just about anything and get the same result. Rate-limiting isn't the job of the protocol, in this case - it's the job of the chat server application.

The lesson is that you can't authorize indiscriminate access to public services on the internet for single-factor authenticated users.

edit: Ugh, Wordy. Shorter: Identity is more than a public key.