This is indeed a concern to me.

As others pointed out, blocking IP addresses is an option. Blocking access based on the HTTP Origin header is also possible.

I hope I can go on for some time without being to restrictive. With a fairly quick API that can scale with cheap VMs it should be feasible to keep it running at low expenses even at higher utilisation.