Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or am I way off on this?
You would need some way to differentiate between a bot-submitted form, and a user-submitted form, which is actually not possible (after all, the bot just needs to "copy" what a user would have submitted and there'd no way for the server to tell the difference).
Also, one thing I've been noticing recently is that a lot of "spam" (e.g. comment spam on blogs, etc) is not actually bot-submitted anymore. Captcha and email verification etc has made it more cost-effective for the spammers to employ people in 3rd-world countries a couple of cents an hour to manually go in and submit their spam. So any technique which relies on differentiating between humans and bots is becoming less and less effective.