Sounds like Google isn't doing any validation beyond checking that the token is valid. At the very least, they should consider adding validation against various

Sounds like Google isn't doing any validation beyond checking that the token is valid. At the very least, they should consider adding validation against various accounts (if any), the IPs associated with the token, and a few others. It sounds like it would help to reduce the false positive rate. As for a bot getting a human to "seed" it, there isn't much they can do aside from throttling the rate of automatic passes to once every 20 seconds or so. They could tune that parameter to balance between usability and bot detection.