Sort:  

This right here.

Not sure about technical feasibility, but that certainly be a solution.

Any bot interacting with the API could get around this easily

Just don't allow users (bots) who are directly interacting with the api to flag? :)