It has to be trivial, but I just cannot get through it. I have to limit amount of tasks (let\'s say connections, emails sent or clicks in the button) per amount of time. So
You may also consider storing {action, time, user} information in a database and get number of actions in a last hour fomr the DB (or similar persisted storager) if you need to handle Application pool restarts / crashes. Otherwise clever user may circumvent your in-memory protection with overloading your server.