Can't you just require a verification e-mail for an account or ban a whole IP range? This happens almost every day.