Rate-limit email to users

[phavekes]

This issue is imported from pivotal

It it possible to use tooling to replay the web-calls that send an email to logged-in users, eg. the password reset email. This could cause email-systems to start blocking our emails. To prevent this, we should rete limit the number of emails sent to an user.

10 emails per 5 minutes should be enough for normal operations