Interesting story and not surprising either. A simpler way would be to allow the booking, and then randomly award the booking. Additionally, require credit card etc and something other PayPal that cannot be changed.
I think that would stop it, because if you cannot guarantee a booking there would be less interest in botting it.