What Is Rate Limiting?
Rate limiting caps how many requests one client may make in a given window. Past the cap, further requests are refused, usually with HTTP 429, until the window rolls over.
For a form endpoint it solves a different problem from spam filtering. Spam filtering judges what a submission contains. Rate limiting judges how fast they are arriving, which is what stops one script from posting ten thousand times overnight regardless of how convincing each message looks.
Choosing what to count on is the whole design. Per IP is the usual default and it punishes shared networks, where an office or a university sits behind one address. Per endpoint protects the form but lets a distributed bot through. Most systems combine several counters rather than trusting one.
A limit that returns 429 without a Retry-After header leaves well-behaved clients guessing. Sending it costs nothing and turns a blocked request into a scheduled one.
In WebForms
WebForms rate limits ingest at the edge and returns 429 with the standard headers, so a burst from one source cannot exhaust a form's monthly quota.