Techniques other sites use: * CAPTCHA * Require single-sign on via Facebook or Google+ * SMS token * IP throttle No, none of these are remotely watertight

Techniques other sites use: * CAPTCHA * Require single-sign on via Facebook or Google+ * SMS token * IP throttle No, none of these are remotely watertight and no, not every developer is inclined to connect to their VPS via Facebook (or even has a FB account). Just saying, these are ways other sites try to add a bit of friction to what could otherwise be a runaway script spinning up thousands of servers. And without requiring a credit card.