To say you can't stop item selling/gold selling is absolutely disingenuous.
Know a really stupidly easy way to instant-kill any bots?
First of all: you don't sell the game retail. You sell it only on your online account. In order to buy this game, you have to provide a debit or credit card number.
Now say you get caught botting/item selling/other illegal activity.
First and foremost, your CD key, your email account, and your game as it pertains to that credit card/debit card automatically gets banned. And second of all, since I'd have your credit card/debit card number on account, I can hide the latter portion of my EULA somewhere 3 quarters down where you'll definitely scroll past if you just scroll to the bottom and click "I agree" that if you do cheat, well hey, I have your CC/DC in my database, so as a penalty for griefing the legitimate players, I'm going to gouge you for another $100 for a game you may have paid $60 originally from.
How do you detect cheating? Easy. Statistics. Keep message logs in every game. This is extremely easy with Diablo type games in which it's not a single persistent server. Do you have (EG sdfgxfkbndmfg) joined the game. Level 1 (how they get to nm/hell is beyond me, glitch rushes, go figure). And now they're going to spam.
"BUY OUR ITEMS!!!! WWW.PHATLEWTZ.COM!"
"UNID SWORD OF NOOB SLAYING, RED RING OF DEATH, SHIELD OF ALL BLOCKING!"
"ALL $5 OR LESS! WHEN YOU PURCHASE, GET A FREE BOOTS OF BETTER LOOTS!"
And of course, those three lines don't come up at a rate of 100 WPM or however fast somebody types. They get copy-pasta'd in all of 2 seconds.
So, how many different "this is a bot" giveaways do we have?
A: a long string of consonants. I suppose this can be subverted with some vowels thrown in. Such as aserseraweasdfser. But stupid bots might get caught by this.
B: Level 1, or other extremely low level for the level of difficulty they're joining.
C: Usually this toon is "naked" or has no gear on themselves whatsoever. If you assign certain numerical values to gear for the sake of detecting this kind of thing, you'll see that these guys are easy outliers.
D: Caps spam. Once again, another easily subverted one, but some bots might do this. Another easy catch.
E: Website extensions. ".com", ".net", etc...
F: The $ symbol. Or heck, #.## or ##.## (price advertisements).
G: Ungodly WPM. In my example, that's 31 words. They'll pop out usually in 3 seconds. That's about 10 words a second, or 600 WPM. I'm not sure if any human alive can hit that. I'd be amazed at 300 WPM.
After every instance of a game closes down, just run this script over the chatlog. It should take all of a couple of seconds. Wham, instant ban.
It's really the same kind of crap that Gmail uses to send stuff to your spam filter. Imagine if these bots tried spamming your gmail. Wham, instantly to the spam bin. Why can't blizz do the EXACT SAME THING?
Worst to worst, heck, tell you what...
If I'm a game company and want to prevent this thing: create a special item called "sigil of the just", which gets obtained by reporting spammers like this. Make it be something along the power level of the annihilus small charm in D2. Bot comes on, someone goes "print screen", emails blizz the screenshot and their account name/character name on whom they want the item, and next time they log in, wham, brand new shiny piece of power, and one less bot on the realms. This is all very very simple.
And then, on your website, have a counter of "accounts banned today", and every so often, have a press release saying "over the last X months, we've banned X00,000 accounts. We take a hard stance against cheating and underhanded practices. Anyone caught doing this will have their account banned without warning."
So not only do I profiteer from cheaters underhanded policies (oh hey, nice item selling website. Account ban, gouge your credit card, try it again and the same thing will happen), but I also build my brand with upstanding legitimate players.
What's so difficult here?