We have a form on a commercial website which has been abused (but only once or twice) by someone from a particular IP address.
A colleague wants to blacklist that IP address from the website.
Seems to me that's overkill, and that there's a risk that genuine customers sharing that same IP address would be blacklisted too.
I suppose a big part of my question is how many people might be sharing that same IP address and could be affected by our blacklist. I suspect that's a "how long's a piece of string" question but some ballpark answer would be really helpful.
We're in the UK if that's significant.