i think in the long run we need to move to something like requiring pow for new posts of new users or the npubs themselves. the attacker is using multiple IPs. @mazin 's purgatory type of structure may also work