The point here is that this should be more technically difficult to do, or some human should be involved. It looks like one of the root causes is that the server-side validation isn't comprehensive enough. That part should be fairly easy to fix.