I believe there's a global player.pl in the latest source. Would have to look it up, but that would be a start for something like that.
Basically, when they enter the zone, record their position and set a timer. If they are in the same spot as the last time you checked (set a variable for x and y) do a function similar to the buffbot you had ages ago where it would verify if you were a person or not. (via typing in a random string of characters). If they do not finish the challenge in 1 minute, delete the global and kick the character.
Something like that would be great. Maybe even spawn NPCs on them or something depending on their HP value, or in the case of EZ, check their client flags. Then despawn the NPC after it spawns after 30 seconds. Can even be a random reward for being afk if they kill it. Or rotate between things that happen using chooserandom.
Lots of things you can do. I agree that having one scenario is easily bypassed. RuneScape had the same idea that I am discussing; on almost any action it had a 0.1% chance to trigger a random event. See:
http://runescape.wikia.com/wiki/Random_events