They would just have to limit requests by IP and thats it. Say 10 tweets per IP per day. For requests which do not come from logged in users.
I can't see how scrapers would be able to come up with enough IPs to make a dent in Twitters costs.
I deal with these constantly for our clients. It’s amazing how smart they function to get around limits (thousands of IPs and valid recent user agents) but how they miss easy things like using the same cookie to submit 1000s of different entries with obvious purchased lists of names/emails, many of whom are deceased.
Reality would be that limit would have to be much higher.
https://twitter.com/SarahKSilverman
I check it ONCE per day, thats it. and for weeks every time it just prompts me to login. no thanks, done with Twitter.
So apparently not enough false positives for them to care.
Secondly, if they would, they could simply rate limit by the first x chars of the address.
And for the "simply log-in": It is even more expensive (way more expensive) to get good email adresses as it is to get good IPs. Email providers have very tough checks these days before they give you one.