Earlier quoted context omitted.
How many spammers invest months / years to upload and modify content to fake legitimate user accounts?
All it takes is one to write the code.
To avoid detection, you can't just make API calls for six months. You have to run the official client on the machine for six months, and then the official client can collect more data on your usage pattern. Imagine the cost to run hundreds / thousands those accounts.