Resolving this issue involves going through the handlers in the modules/ tree alongside the matrix client and server specification to flag methods required to be rate-limited. Currently some are, but many are not.

Example of a method with the flag:

resource::method
method
{
    resource, "GET", handler,
    {
        method.REQUIRES_AUTH |
        method.RATE_LIMITED
    }
};