Alternatively, what about silencing them? They should have no posts and be (unless you changed the default settings) trust level 0, so their account will cause no harm. They won’t even appear in the user directory and will be purged periodically with the CleanUpInactiveUsers Sidekiq job (default value: 2 years).
Tho I guess that this automatic deletion will also send an email when it occurs then? 
But I doubt spammers will use the same email address for 2 years…