phaolo: Maybe they just stay logged in..
Barefoot_Monkey: Probably this. A bot doesn't need to log out of one account to log into another, but can be permanently logged in with several sessions concurrently, each with a different account. The initial logging in is such a small amount of once-off work that it can be done by the human operator, who might not even be given a captcha to do.
Huh. Yeah, I guess I should have realized that: A single IP address might be a network of several machines, so GOG would need to allow multiple sessions from the same IP. Without checking the MAC address (or whatever they call the physical address these days; it's been a while since I brushed up on this stuff), I suppose there wouldn't be any way of knowing the sessions were originating from a single machine.
And I didn't consider that bots wouldn't ever need to log out, so a one-time human-assisted login wouldn't be a big deal. I blame GalCiv3 for eating up too much of my attention lately. ;)
I guess bots might be in use here, after all, since it seems much more trivial than assumed. Anyway, thanks for the info!