Forcing you to query IA at least reduces the frequency of feedback, as they're taking snapshots instead of giving a live feed. You could also shadowban IA. You can also do things like guess based on IP address or browser fingerprinting, or require a login from various IP ranges.
Of course your main point - that this is all terribly imperfect and won't stop a determined, sophisticated user, who has realized what's happening - is spot on. That, however, is perhaps a rare combination, rare enough to simply continue dealing with manually.
Of course your main point - that this is all terribly imperfect and won't stop a determined, sophisticated user, who has realized what's happening - is spot on. That, however, is perhaps a rare combination, rare enough to simply continue dealing with manually.