Very good questions! I was actually thinking about that right before launching last night!

I'm planning to blacklist certain problematic hostnames and not let folks add them.

In terms of rate limits, it does have rate limits when it comes to collecting analytics (if you spam click a link >10 times in 10s it still redirects you but it stops recording clicks.

I can't think of how URL looping could bypass checking – could you elaborate?