Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained

Alert boxes tend to be horrible in terms of usability, but it is the only way to actually require a second step, since anything else you do will be constrained to the iframe and you can just clickjack a second time. I think the solution they'll end up implementing (if they do anything) is an "I didn't Like this" link that users can click to report false clicks. If a company gets more than x% of those they get taken down. It's not a legit solution but should be fairly effective.