I agree with several posters here who say to use Cloudflare to solve this problem. A combination of their "bot fight" mode and a simple rate limit would solve this problem. There are, of course, lots of ways to fight this problem, but I tend to prefer a 3-minute implementation that requires no maintenance. Using a free Cloudflare account comes with a lot of other benefits. A basic paid account brings even more features and more granular controls.