id try using a captcha, not perfect but they might give up...also worth trying control the ip where those requests come from: duplicates would be suspicious, triplicates or more worth human attention