How would you deal with captcha? Could we avoid that altogether? Or make it the only action on the user's part is to enter the captchas?
Alternatively if you have 30+ paid accounts with some small company, you could ask them for whitelisting your ip. They might be interested in doing this.