And just curious...if bots were the problem why not just disable the scripting system?
It'd be a good solution if it worked. But in reality i think it'd be be a nightmare. Disabling the scripting system itself would really do nothing (advanced bot writers can easily hookin without an official API easily). So you'd basically have to constantly be finding bots and banning them. It'd be an arms race that you'd always be on the losing end of, I think.
You are right, it's simply not possible. Just take a look at eg. Tampermonkey. It is a browser-plugin which supports writing code which in the end simulates user inputs (putting text into text editors, clicking buttons, following links, ...). A site has simply no chance to detect if a user input originates from a "real user" or from a bot. Taking any actions against such scripts has a high probability of false-positives leading to the fact that you ban real users which you wrongly identified as bots.