Did your friend enable iCloud Private Relay by any chance?

Either way, you're probably optimizing too prematurely for sure. Before you have any users, the right way to do this is to a) either setup Turnstile and don't worry until someone complains, or b) set up a 60 requests per minute global rate limit (just in case). Once you see people are abusing it, you can try to find out what it takes to fix that.