It would probably be better to allow users to provide their own additional rate limiting identifier by pushing it. That way you could configure it to run of (for instance) MemberID rather than IP.