I'm developing a web based service in which users must validate their mobile phone (using a code sent to their mobile number via SMS) and email (using a verification link). Currently I use time limiting method to prevent sending more than one SMS or email in a specified period. But both of these security factors can be changed by users whenever they want and by changing them, their time limit will be resetted too.
A hacker can automate this process (since I don't want to use captcha in user's panel) and infliction us to send a lot of SMSs. How can I prevent it? One idea is that to lock users from changing these information too fast but I don't know if it is the best way or not because users might fill these informations wrongly and want to change them instantly.