As they doesnt require a key , should be by ip address from Mobile and Pc using a static IP
If the project is hosted on a server maybe more difficult to track , because the server can use several dns ( or not ) .
If using a VPN maybe they cant track but its a risk to the vpn IP get banned
If who will make the request is the user , they will make only once the request from that Ip , so "in theory " shold be ok using the api , because allways the request will come from a different Ip Address !
dop2000