I have written a post about my experience running a bitcoin testnet faucet for the last seven years. It is about how I have created countermeasures against people who try to spam the faucet with requests: https://kuttler.eu/en/post/detecting-fraudulent-activity-bitcoin-testnet-faucet/