it's explained pretty well in their blog post in another thread. They have a whitelist of bots catergorized by type, and ban everything else. How easy it is to spoof (just the UA, or UA+IP whatever) is not mentioned.