Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or am I way off on this?
You would need some way to differentiate between a bot-submitted form, and a user-submitted form, which is actually not possible (after all, the bot just needs to "copy" what a user would have submitted and there'd no way for the server to tell the difference).
Also, one thing I've been noticing recently is that a lot of "spam" (e.g. comment spam on blogs, etc) is not actually bot-submitted anymore. Captcha and email verification etc has made it more cost-effective for the spammers to employ people in 3rd-world countries a couple of cents an hour to manually go in and submit their spam. So any technique which relies on differentiating between humans and bots is becoming less and less effective.
Probably because the event handler is simply a function like any other. If you put a "source" argument into it, all the malicious code would need to do is call the event handler manually and pass the "from user input" value.