depends on what they are rate limiting. if they are trying to rate limit logins to prevent brute force attacks... I could see a naive implementation being problematic for NATed users.