As noted in TFA, as well as on the product page itself (http://www.google.com/+1/button/), +1 only works if you are logged in to your Google account. Spamming it would require controlling a large number of fake accounts, which is not easy.