I just noticed you said control endpoint. You could possibly do it several times a ms. Table 5.2 of the spec tells you the maximum number of control requests you could possibly do depends on the transfer size, but is 32 for 1 byte transfers.
I'm not sure a real world EHCI controller could manage that though.