Regarding the abuse, have you tried hashcash style challenges to mitigate them? Basically, you serve a random, signed string S; have the client brute force x such that prefix(hash(S+x),0,2)==“00” and submit that along with the search query. The problem with this approach is the client can offload the calculation to another machine which is part of a botnet. There are more advanced passive and active fingerprinting methods that you could use, but they require non-trivial infrastructure to collect said fingerprints, not making it worthwhile for a side project like this.