Ahh how silly, I should have realised it could be done...I even posted that 185 guests thing in chit-chat.

Isn't the point of sessions to stop that?

Can't sessions for guests be added into the database with their ip and last activity and if they try to do something every few seconds then block them?