Another measure would be initiating a bot-check for every user. Maybe even periodically.