I hadn't considered bots... thinking about it if someone's gone to the trouble of writing a bot they should have no trouble by passing the tracked IP numbers / restricted access to the rate page - the same is true for visitors using proxy servers.

One way around proxies is to track local (client's machine) IP's using this applet - the drawback of this is people can disable Java on their browser.