Open REST API attached to a database- what stops a bad actor spamming my db?

I'm a client side developer with little experience of server side, and I'm struggling to understand how to make a database-backed website without requiring users to login.

The usecase is fairly straightforward. The user lands on a website, uploads an image, and performs some processing to that image. Clicking 'share' POSTs JSON to my endpoint, stores it in a DB, and returns a unique URL in a textbox (eg, https://example.com/art/12345) which allows the user to share their artwork with others, or just to come back and do more editing later on.

What stops somebody from doing, POST <data> https://example.com/art 100 million times and filling my pay-as-you-go database?

I've seen examples of this sort of sharing behaviour on plenty of sites but I don't understand how to stop abuse. I do not want users to have to login.