For example, the player @qurator-tier-1-2 has already some bots. I can never attack this one anymore. On top of this, the player itself is part of a bot on STEEM, which makes all this very hard to manage.

Although I agree limiting will reduce the bots, it will never avoid them. And because of the capability of STEEM accounts, it would not work. People will just create more accounts to have strategic scripts working on them.

I think that should be a "luck" aspect to when a player attacks. Like a sliding scroll (anti-bot features), or something like @properfraction said "Maybe a captcha should be added before each attack", and if during that period, more than 1 player slides successfully the scroll, a roll is done, to which one attacks. This will both kill bots and also allow attacks to be fair (in my view).

FYI @drugwars