You likely have more experience with this than I do, but it seems to me that getting access to 36,000 IPs (the quoted maximum amount per minute) to make a single request each would be extremely difficult. And even if you could do that, most of them would probably be in similar blocks which would make them easier to detect and stop. It just is really hard and/or really expensive to get access to that many IPs (short of running a large botnet, which also would be hard and expensive and illegal).

Based on QVC's inability to stop this I think their tech competence is probably fairly low, so my guess is that result.ly just would spin up 100 AWS instances, crawl for some amount of time (with a spoofed user agent), then close those down and spin up another 100 instances, then rinse and repeat. For QVC it would seem like you are constantly facing a moving target with all these different IPs, but in fact it is just from AWS.

The complaint is of course inaccurate in that it is impossible to lie about the source of the request. Whatever IP the request was coming from is the IP it was coming from. Perhaps in the case of an AWS instance Result.ly is only leasing it for a short time, or in the case of a proxy it is the proxy's IP, but obviously it is still traceable to the owner somehow.