I do think there's still room for data-driven methods that detect this type of thing. All the data is out in the open so anyone can build heuristics or algorithms for flagging non-human accounts, for instance. Those algorithms can then be open sourced for any relay operator or client to use. 

 This also doesn't require any changes to the underlying protocol