My own recommendation: disassemble any official app (for example, the Android one with apktool) and get the tokens and endpoints and do whatever the hell you want without paying a cent.
More importantly: they introduced a lifetime cap on the number of OAuth tokens that applications could create, which meant a lifetime cap on how many different users a Twitter client could support. Once you hit your Nth user, you could never have a new person authenticate that client.
That killed off basically every decent third-party Twitter client.
And you can do it if you want. I do it. I'm sure many more people do it.
By spamming I don't mean the usual "click on this link and I'll show you my tits" spam; if you create a useful bot that sends "expected" mentions (for example in response to mentions you receive, and not just spam) it will get banned in a matter of hours. With their "secret" tokens, it won't get banned.