> although it does run tiny risk of being trivial to mess with if a malicious client wanted to skew numbers

Is that not also the case with the UUID solution? Generating the UUIDs in virtual machines, or just replacing the UUIDs in the requests, doesn't seem out of the question