It also helps when trying to put limits on greedy users or maintain a ban-list. Attribution is also important, like you said. Granted, an abusive user could just keep creating new keys, but if they require something like email verification then it's a little bit costlier to circumvent than nothing.

EDIT: Based on other comments, there's no email verification.

There isn't currently, but they could add whatever requirements to generate new keys in the future they want. If they didn't have keys that would break every existing client.