I’ve wondered this too. (Like… when is it ‘ddossing’?)
All I know, is that you can send 350 authorized calls per hour. When it’s authorized, this will be removed from the user in question.
You guys (or your app, to be precise) will only lose ‘tickets’ if you’re making unauthorized calls. When you do this, you have 150 per hour.