[momoro]

I think sites like quantcast, compete, google analytics etc tend to not include bot traffic b/c bots often don't evaluate javascript, and those tracking services often use toolbars/ajax requests that bots don't have.

So, pointing to pageview graphs that track ajax requests / toolbars and assuming that it's mostly bots is likely to be a false assumption b/c bots are likely not included in those pageview sums.

[teaspoon]

The "Like" and "Follow" buttons on Tumblr require JavaScript, probably to make CSRF harder. A bot that automatically likes posts would need to evaluate JS.

[citricsquid]

Liking a post on tumblr is just a POST request; it doesn't require Javascript. You can scrape the page (for the content id and authentication key) and submit the POST request to like the content without ever running Javascript.