Tor largely prevents most approaches to this. You'd need some way to provide a ticket to a given client, check for it later, and, preferably, ensure anonymity over time.

I've just posted top-level in this thread listing two projects of which I'm aware that provide this, though as experimental protocols only. I've been mildly agitating for further development of such tools. Looks as if CloudFlare are working in a similar direction, which I see as positive.

If you are a valuable enough target, this is not an option.

IPs are cheap, if you let someone try 20 times in an hour before banning an IP, there are targets that people will cycle through IPs that quickly for.

You would have to limit it per IP address if you do not want to after all clients. So it would not be effective against someone who can use many IP addresses (eg. with Tor)