The disclosed embodiments relate to a system that detects and controls operations performed by abusive accounts in a customer-relationship-management system. During operation, the system obtains account-related information for an account in the customer-relationship-management system. Next, the system determines a likelihood that the account is being used for abusive purposes based on the account-related information. Finally, the system limits a rate of processing for application-programming interface (API) calls made from the account to the customer-relationship-management system based on the determined likelihood that the account is being used for abusive purposes.