How can I protect the service from external calls?
Well ... ANY user trying to register will be an "external call"!
I do not see how verifying a username will pose a security risk. The bot could simply register as fsdjiojiejfiowell as be sure that no one had done this before.
, , .