They absolutely can. This is what bot developers did in Runescape after Jagex implemented the same system. It blocked bots for a few months, but after that it was pretty much useless.