It gets modest usage. We can limit usage based by "key", but currently don't have to. It does have fair queuing; if you submit a large number of requests from the same IP address, you won't delay requests from other IP addresses. This is enough to deal with anything short of a determined DDOS.
[1] http://www.sitetruth.com/doc/sitetruthapi.html