Hi sixdimensional, thank you for the insightful comment here. I've been researching this area, and I'd love to chat more with you, would you be open to that? My email is on my profile page, feel free to email me on that address and I'll follow up.
Credentials through phone # is more of a deterrent. We're also going to have an in-person coding exercise as a next step, which would be much harder to game :)
I love that people do this. Do you really thing someone is going to write a web scraper and NOT include obvious things like converting AT -> @ and DOT com -> .com?
Also, who even worries about spam any more? I haven't seen actual spam in my inbox in years.