would'nt GET be prone to some kind of spider GETing all links it came across (for indexing) causing data centre havoc ?

Details - not if we don't include authentication information, check user agents, etc. but if we feel it necessary to keep sharp implements out of the way of the children then we can.

Here's the rule (http://www.w3.org/TR/webarch/#safe-interaction): "Agents do not incur obligations by retrieving a representation."

That is to say, spiders and pre-fetching proxies and so on are perfectly entitled to GET any link they see, and if mayhem ensues, it's the server's fault, not the client. People often say "GET should not cause a change in state" which is wrong, because it writes logfile entries and sets cookies and all sorts of stuff.