You prevent abuse of the API by models the same way you prevent abuse by humans: you have server side checks.