Wouldn't limiting the number of IP addresses that can log in as a single user avoid the botnet problem?

That said, someone mentioned that the login page alone involves 11 MB of data transfer, so maybe that is the problem they are confronted with.