one account ran 4,100 jobs in 48 hours on a $12 plan and then filed a chargeback

Do not let this one incident push you into a fortress. One abusive account out of however many hundreds is normal and the cost was $180, which is a bad afternoon rather than a business problem.

Specifically, resist adding identity checks at signup. Every friction step you add to stop the one person costs you a percentage of everyone. Cap usage, alert yourself, and move on. The dispute ratio thresholds that get quoted around card network monitoring programmes come with monthly event floors in the thousands, so a solo product is not at risk from them — your realistic risk is your own processor's risk team noticing an unusual pattern, and one dispute does not do that.

Guard rail first, because that is the part you control. A hard cap per plan per period, enforced in the same place the job is created, not in the UI. Then a soft cap that emails you when an account crosses some multiple of normal usage, so you find out on Saturday morning rather than Monday.

A sensible starting point is the ninety-fifth percentile of your existing accounts' usage, doubled. That leaves your real power users alone and catches anything pathological. Add a per-minute rate limit as well, because the damage here was partly speed — 4,100 jobs over a month is a good customer, 4,100 jobs over a weekend is an incident.

Also put a spend alert on your compute provider. That is the alarm that fires when everything else fails.

On contesting: know what it costs before you decide. The processor charges a fee when a dispute is raised, and since a change a while back several of them also charge a second fee when you choose to fight it, refunded only if you win. So a $12 dispute can turn into a meaningfully larger loss for the satisfaction of being right.

With logs this good I would still submit, because the evidence is strong and card networks do reverse these, but do it with your eyes open about the arithmetic. Check your own dashboard for the exact fees rather than trusting anyone's numbers including mine, they have moved more than once recently.

Two cheap technical things that catch a surprising share of this pattern before it starts. Require a verified email before the first job runs, which stops the throwaway-address loop. And delay the heaviest operation for brand new accounts — new signups get a lower concurrency limit for the first few days, then it lifts automatically.

Neither is visible to a normal customer. Both would have turned your weekend from $180 into about $6.

One more thing worth doing while it is fresh: write down what normal looks like. Jobs per account per day at the median and the top end, cost per job, and what the worst plausible weekend would cost you. Ten minutes of arithmetic now means the next anomaly is a number you recognise instead of a surprise. I did this after a similar incident and discovered my worst case on the top tier was genuinely unbounded, which was its own separate problem.