Currently, rate limits unauthenticated requests from clients that follow the user-agent policy use the value of the x-ua-contact header as the rate limit counter key. This assumes that the user-agent provides the contact info of the bot's operator. However, it's quite common to provide the contact info of the code author instead, e.g. for OpenRefine (see issues/7731).
Instead, we should use the client's IP address as the counter key. This would also prevent spoofing of the user-agent string to circumvent rate limits.
The downside is that it becomes harder to get a list of the user-agents of the top clients. But this data can be extracted from logs.