However, attackers can easily write a script to call the logging service. The script would use our domain as the referrer and use our API key. Our competitors can spam our logs to make analysis impossible and waste our time responding to alerts.
Is it possible to protect against this? Even if we use our server as a proxy to call the third-part API, attackers can just call our proxy.