We currently do not have any rate limiting but we’re closely watching how people use our API currently so we could impose sensible yet strict limits.
I think the numbers you have are actually pretty low. For a campaign with 5000 pledges and 200 pledges/page, that means that to fetch all pledges it’ll take 25 requests, which with your limits will take 2 hours minimum, and will only be possible to do 8 times a day.
I think 1000 requests a day is more sensible and allows more flexibility.
If we ever see naughty clients via our logging, we will email the author and in extreme circumstances, will disable the client or the oauth token that is being used to create those requests, but those are extremely rare and most of our clients have been acting in a sane and responsible manner.