How can you design a rate-limiting system that prevents abuse without blocking legitimate users who share the same IP address, such as users on a university or office network?