This doesn’t fully address the issue you described but…
If most of these spammy / suspect users share the same stats you mentioned here
then, have you considered changing the default for the clean_up_inactive_users_after_days setting?
It’s set to 2 years unless you change it, but I see no harm in reducing that by quite a bit.
It only deletes users with 0 posts and 0 reading time.
Setting it to something like 2-3 weeks is very reasonable. Anyone that signs up to a Discourse site and posts / reads nothing for 2-3 weeks is obviously not a real person that you want to have on your community.
Even if they are, 2-3 weeks is an acceptable amount of time for their account to be deleted because they probably lost interest and so it’s okay for them to have to go through the signup process one more time if they are really interested.