If you run a website and you're getting spammed, the worst thing you can do it also ban the accounts as this give spammers feedback that the account is no longer valid to use and they'll rotate it out. Best thing you can do is /dev/null the account. To the user it will look like account is working as expected, but on the back end anything they do doesn't actually do anything. Harder for spammer to know when that account is burned. This way they'll continue to use it, and you can use this data to find related accounts and /dev/null them as well.