Kate Turner wrote:
that's quite consistent with someone loading some edit pages in browser tabs, submitting them all at once, and then loading a few more. i've done it before myself, though for slightly more legitimite purposes...
Right, me too. I've tracked down the squid log entries for large-scale vandal attacks several times, in most cases you see the user loading edit pages (or move page confirmation pages) in batches beforehand, with a typical user agent and all referrers intact. Faking referrers is possible, but the confirmed bot authors haven't bothered. They usually start with the simplest script possible, and then progressively add stealth features as we add filters and throttles, in an arms race.
Never underestimate the power of a bored teenager with Firefox.
-- Tim Starling