Thanks, @Bas!
It seems to me that I should not be getting these 429s regardless of any settings mentioned in that post. In the example I provided, I sent 15 requests which is under all of the default API limits. I did this using an admin API key and username.
The example doesn’t exceed the following per-IP defaults:
It doesn’t even exceed the non-admin limits:
Changing DISCOURSE_MAX_REQS_PER_IP_MODE to warn or none did not help.
Am I missing something? 
BTW, I changed the settings by editing app.yml and running ./launcher destroy app && ./launcher start app.