This spammer kid eventually relented and had a conversation with us. It was very interesting. He admitted it wasn't a bot, it was just Ctrl+V. So you know what I did? I added a client-side rate limite...
ah Ctrl+V spam, like the good old times, the kids are alright