"Unless the striker is adding enough variety in the applications and when they are submitted, I think it would be pretty easy to match and discard the bogus ones"
That wouldn't be so hard to do, would it?
That wouldn't be so hard to do, would it?
Edit: One thing I didn't think of was application source IP address. It's possible the ATS records that info when an app is submitted, so they could possibly delete bogus records that way but I'm no ATS expert and this is literally just my own conjecture.
I base this opinion off of ~6 year old data and experiences. The "best" horror story was an ATS that used client-side browser datetime without timezone support as their official timestamp record for various events.