Say there is a smart contract that involves a buyer and seller. Anyone can instantiate this contract but eventually two parties, the buyer and seller, will register with the contract. A seller would like to create a service that invites buyers to accept contracts with them, so they create a (centralized) web site that instantiates new contracts on the server whenever a buyer is interested, and then shares the address of the new contract with the buyer so that they can register through a transaction on the blockchain.
Given this model, how does one prevent a malicious user from draining the seller's funds by repeatedly triggering contract creation through the website with no intention of registering as a buyer?
Is there any way to prevent or discourage that attack while maintaining the constraint that the seller is instantiating the contract?