In reply to Otto.

In this situation, it wouldn't matter if they wrote their password on a post-it note and stuck it to their monitor since the bot wouldn't have access to that.

Unfortunately I don't think there are any better solutions to passwords just now, so in the interim I think making people use good ones would be nice, if only to prevent these silly DOS attacks from occurring. Multi-factor authentication would work as well, but I think too many people would object if that were made compulsory.