UPDATE: Thanks goes to +ewgny for pointing out it is good to throttle or even block requests from both bots and humans.
Immediately block fake Google crawlers: YES
How should we treat Google’s crawlers Unlimited Access
If anyone’s requests exceed: 15 then throttle it
If a crawler’s page views exceed: Unlimited
If a crawler’s pages not found (404s) exceed: Unlimited
If a human’s page views exceed: Unlimited
If a human’s pages not found (404s) exceed: 5 per minute then Throttle it then block it
If 404’s for known vulnerable URL’s exceed: 1 per minute then BLOCK IT
How long is an IP address blocked when it breaks a rule: 1 Month
"Hey It's Bill And Mike, Grab Your 101 Free WordPress Plugins Below"