I think that's the way to go with the individual who has fewer than 50 requests, but when you have three people generating 800 requests, a third of your work, it seems a little bit excessive.
In terms of privacy, do you disclose the name of the requester to the department where information is being sought?