Yes, I'd thought about roughly the same premise before and came to the conclusion that it really is a hard thing to do.

Even if you use state ids for it, who's to say that a particular state won't be...loose with issuing ids that can then go on to be used for bots.

It's even a problem with humans as well - one human can be having a pleasant conversation with the other, not aware that that person isn't being genuine, or is lying, has ulterior motives or has been instructed on what to say by someone else.