After the initial violation they have not been doing more than a couple PMs per day so rate limiting would not work. Upping the trust level also doesn’t work too well since they are “playing the game” and putting in likes, followups, etc to bump themselves up. I think we will just keep doing what we are doing for now, we do check new user accounts in particular and anything abnormal and we mark it on our internal mods wiki for close monitoring.
Looking into proxy blacklists it looks like squidblacklist.org for $10/month gives you 44K proxy servers. That would be a worthwhile investment for me. It doesn’t really require Discourse support since I could just stuff it in .htaccess on my Apache server.