> Did your friend enable iCloud Private Relay by any chance?

Nope, he did not

> a) either setup Turnstile and don't worry until someone complains, or b) set up a 60 requests per minute global rate limit (just in case)

I guess technically a) is what I've done and my friend is the one who has complained.

But you're right, it's definitely premature optimization and I'm now doing the uncomfortable thing of trying to do marketing and get more customers instead of the more comfortable engineering work...