Anyone have experience with a bot hitting a form on a site?

I had over 20,00 submissions to this one form from the same individual.
It's pretty sophisticated, as the submission form sends a confirmation to what must be a unique e-mail address - and this bot or whatever the set-up was autogenerating serialized e-mail addresses AND triggering the activation replies!!

Anyone use captchas?

I'm considering auto-banning IPs that multi submit. ( I've started auto-logging IPs on all form submissions, abd it's easy enough to redirect based on IP to a " get lost" page.

- Any suggestions -

Dave

I would first suggest captchas, however it depends on the nature of your site. Other than that setting up a flooding failsafe mechanism would also be good, at least it would help save on bandwidth if you send them to a blank page after they have been blacklisted.