If they really wanted to combat bots, they could add the further measure of a temp ban on anyone trying to log back in before the ten minute wait is over, or at least anyone trying repeatedly.