This question already has an answer here:
We have a user who claims to have a vendetta against our community. We run a fairly large social networking website, and for the past four or five weeks, this particular person (or maybe people?) has been spamming our largest discussion groups and personally attacking other members by leaving hateful comments and death threats on their pictures.
We employ CAPTCHA and email verification on signup. We also have cross post analysis that catches users mass-posting a single thing to a lot of groups.
It seems as if he has hundreds of legit emails (they're all gmail, hotmail, yahoo) and looking at our logs, it seems as though he's sitting there and legitimately solving these CAPTCHAs. For hours. Every single day. When he caught on to our cross post analysis, he started generating random titles and bodies to post. He'll hit a dozen of our top groups with those over and over again until we delete his user account or he gets banned by a moderator.
His IPs change constantly. Many are Tor nodes, some are vanilla HTTP proxies. His user agents change for every new user he signups. Sometimes they're even "GoogleBot", which I thought was amusing.
So my question is, are there best practices we could be following besides employing CAPTCHA and email verification? Ones geared towards an extremely motivated human generating spam?