I have client/server data passing all working correctly. Text, Images, etc. My users create blog-type posts on their android device, and upload to my server.. All is done using HTTP Multipart and Input/Output Streams. My issue is - How do I know the client is actually my app and not some script/other hacker app?

I want to avoid abuse scenarios. 

1. Malicious user A creates a PC script that sends the appropriate form data to my server and is able to spam the server, creating 1000s of malicious posts.
2. Malicious user B creates a simple Android App that sends the appropriate form data to my server and he is able to spam the server.
3. Malicious user C signs up to my service, Has a valid account and password, and he spams the server using a PC script or Android App.

One idea I have is to force a wait period server side on frequent posts to prevent spam.. 

But beyond that, how can I check that the person sending data to my server is 

* An android device and
* Is running my App to send form data and not another.

I want to avoid SSL as I don't want to register with Verisign, TRUST and go through all of that..