Ya it could be done through small transactions also. But also changed IP access of API should also be verified by faucet owner through email.
That's also already implemented. You can limit what IP addresses can use your API in the security tab in FaucetBOX.com Dashboard. It's called ACL.
Also faucetbox API is just like key to bank account. Hosting provider can easily access it. There must be some security feature for protection from hosting provider
It's technically impossible. If the script can send coins, so can a hosting provider. The only safe way is to host it yourself.
You are right but Like Payment service providers FaucetBOX should look into security of owners by implementing verification of faucet users by Identification cards or Home bills.
Also in Future faucetbox Security Every payouts made by Faucetbox to users should be first verified by the owners of the faucets. Owners may find out some suspicious transaction. Little time limit should be provided to owners to check it.