title: Preventing creation of fake accounts using email and password auth method
body: <p>1) I've found hourly limit per IP in console => authentication => providers. But it says only for a short period of time up to 7 days. Question: why can't it be permanent? and why default value is 100?</p>
  
  <p>2) Is there such a feature that allows account creation with email and password only from specified domains? wouldn't it be useful?</p>
  
  <p>3) Is there any recommended way to prevent a malicious user from creating multiple accounts / generating too many requests to real users programmatically?</p>