Abuse controls on signup

Signups are limited by an email cooldown, a per-IP daily cap, a disposable-domain block and a list of reserved subdomains.

All four are adjustable. Loosening them is the first thing to look at if legitimate signups are being refused.