Dear Lynne,
Here is a sample that I lifted from my access log. The times between the first and second request are indeed quite fast, but the third request tool human-like time.
Code:
121.231.14.208 - - [18/Apr/2009:07:45:13 +0200] "GET /forum/register.php?do=signup HTTP/1.1" 200 12749 126819 "http://java-monitor.com/forum" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
121.231.14.208 - - [18/Apr/2009:07:45:14 +0200] "POST /forum/register.php?do=register HTTP/1.1" 200 19209 39837 "http://java-monitor.com/forum/register.php?do=signup" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"
121.231.14.208 - - [18/Apr/2009:07:47:13 +0200] "POST /forum/register.php?do=addmember HTTP/1.1" 200 10887 893786 "http://java-monitor.com/forum/register.php?do=register" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"