"Suspect users" not behaving as expected?

Things they have in common:

  • Same IP
  • Same registration time
  • All ~2 minutes of reading time
  • All responded to the same thread, with a single post, an image of some text.

Blocking signups would just prompt people to use additional IPs, I need to be alerted to their existence, not present them with an error which will make detecting this behaviour even trickier.