I respect and appreciate no API key being needed, but how will you prevent excessive usage? I'll just say that it's been a battle on my end to stop people abusing APIs I deploy. It's why we can't have nice things.
As others pointed out, blocking IP addresses is an option. Blocking access based on the HTTP Origin header is also possible.
I hope I can go on for some time without being to restrictive. With a fairly quick API that can scale with cheap VMs it should be feasible to keep it running at low expenses even at higher utilisation.