[craiglaw2]

You could add a CAPTCHA to suspect client IPs? You could implement some sort of real-time log analysis / monitoring based on client IP, x-forward-for (?) headers and User Agent, also possibly block certain geo-IP ranges from non-core customers. Inserting a javascript "puzzle" is also a way to test that a browser is generating the traffic and not a script.