There is Flood control
This project is intended to add an administration interface for hidden
flood control variables in Drupal 7, like the login attempt limiters
and any future hidden variables.
The functions to define and interact with core flood control system
The flooding system provides us three functions:
flood_register_event($name, $window = 3600, $identifier = NULL)
Register an event for the current visitor to the flood control mechanism.
flood_clear_event($name, $identifier = NULL)
Make the flood control mechanism forget about an event for the current visitor.
flood_is_allowed($name, $threshold, $window = 3600, $identifier = NULL)
Checks whether user is allowed to proceed with the specified event.
Basically, we check if a user has access by calling flood_is_allowed. If it returns FALSE, throw an ‘Access Denied”. Whenever a user performs the action we call flood_register_event.
By default it checks the user's ip adress. But we could pass some other unique identifier like the user id.
Above copied from Playing with Drupal’s flooding system