I suggested this elsewhere, but I think what may make more sense is to just add a second duplicate-certificate rate limit, this limit being along the lines of no more than 2 of the same certificate in a one-hour period. That way people just repeating the same thing over and over may see that it's a problem before they've used up all 5 for a week.