Usually, this is done with a server request; Github, Discourse, and others, all render the preview on the server. Making a parser that works exactly the same in JS is not practically doable; there will be minor differences and bugs, and both implementations would need to be updated at the same time. It's not viable. The only communities that do that are made in JS in the first place (Node/Deno/etc) -- typically even those render on the server.
And yes, you can get the session from the user (since only logged in users can do that) and record last request time; if delta last request to now is > some time, refuse the request. You can have a Js counter client-side to tell the user "next preview in 1 second" if they click "preview" too fast.
I know what you're thinking