What about creating a parameter that sets a specified number of bots usable by ALL witnesses and users.

The quota per user account can be triggered by authentications per bot account used (say 1 normal user account and 2 bot user accounts, so in total, 3 accounts can be authenticated at single time).

Also, a user cannot have more than 3 accounts. This can be done through database querying and searching for a specific 'identifier' that is similar between multiple accounts (maybe browser header information, an IP address, a location, or a combination). Since each person is unique, the identifiers would be too and if its the same person creating multiple accounts, the 'identifiers' should match.

JUST THINKING OUT LOUD