The browser fingerprinting stuff is big work, but it’s getting to the point now where you can uniquely identify a device across multiple different browsers… it’s creepy af.
Doing IP address aggregation at the AS level is quite straightforward; a plugin that looked up IP addresses from the MaxMind GeoLite ASN databases and aggregated users by AS wouldn’t be a massive undertaking (anyone keen?).
As long as you’ve got relatively dumb miscreants, I agree that moderating their first few posts should be very effective. The tricky part comes when they’re capable of hiding their true colours until after they’re out of the penalty box. I prefer to detect bad actors based on traits that are very difficult or expensive for them to change (like devices or ISPs), rather than data points that are more within their control (like their initial behaviour) or resources that are practically free to obtain (like e-mail addresses).