I sense the horns of a false dilemma. Your question is, "How can I tell legitimate customers from illegitimate?" A better analogy would be, "In a retail store, some customers are actually resellers. How can I prevent them from buying things and then selling them to other people?"

Provided everyone follows the specifications, I'm not aware of any reliable way to tell a "legitimate" web request from an "illegitimate" one. Perhaps you should redo your site in Flash, to postpone scraping? (No, I'm not serious.)