I am not DOSing Hexbear, higher traffic from VPN IP addresses is expected because there's fewer IP addresses per user.

Rate limiting by IP address is an anti-privacy op

Edit: Maybe the rate limit can be increased for login requests?