Hi there
All the anchors that plugins add to your site includes rel=”nofollow” attribute
This means that bots shoulnd’t visit the url for ATW anchors
So, first of all, I’d check if your ATW buttons contain that attribute, and if not you should definitley check if your theme overrides defualt add-to-wishlist.php or add-to-wishlist-button.php templates
Of course, malicious attackers could visit add-to-wishlist link even if anchors contain rel=nofollow
In this case plugin uses a filter over user agant to try to block activity coming from bots
Anway, this is not always possible, as we cannot identify any existing bot
My suggestion here is to work on firewall level, to identify and block IP of the bot that performs the attack over your site
