I'm curious, why don't spammers take cookies when they take useragent + ip etc? Can hardly fail vbv if you have their cookie history. and its not hard to take cookies is it?