Abuse of a content-sharing service is detected by an arrangement in which an in-memory cache is distributed among a plurality of nodes, such as front-end web servers, and which caches each item accessed by users of the service as a single instance in the distributed cache. Associated with each cached item is a unit of metadata which functions as a counter that is automatically incremented each time the item is served from the distributed cache. Because abusive items often tend to become quickly popular for downloading, when the counter exceeds a predetermined threshold over a given time interval, it is indicative of an access rate that makes the item a candidate for being deemed abusive. A reference to the item and its access count are responsively written to a persistent store such as a log file or database.