right, it's not per client; if it was per client you could just ban the abusive clients instead of asking them for pow. anonymity (or freely available new identities) mean that attackers can use a sybil attack to deny service via capacity overload