Wlork This isn't a solution to your issue, but in case nothing else works, I just figured this might potentially give you some alternative ideas.
Early last year on one of my old Xenforo forums, we unexpectedly found ourselves having to deal with a particularly motivated individual who apparently had the skills to easily get around all the various security measures we tried, including XF Support countermeasures too...😅 which only seemed to slow down (and further aggravate) the individual for a few hours at best.
We tried everything from standard banning, deleting their accounts, implementing several paid security add-ons, using the special XF inhibit user feature, as well as completely blocking every single one of the individuals seemingly endless supply of IPs & emails. Yet nothing worked. That is, until I randomly decided to have some fun with the situation.
What I did was more or less lazily create a 'Naughty' user group + category for the sole purpose of capturing & collecting every new account the individual made. I made sure this 'Naughty' user group had almost all permissions disabled, so the individual couldn't do much beyond ranting & raving hysterically within only one single obscure thread I'd set up especially for the purpose of keeping them preoccupied and under the (false) impression that their posts were visible to all members.
This continued for roughly another month and a half before they'd completely given up bothering.
By that point we'd accumulated dozens of dozens of the individual's sock accounts and had also turned the 'Naughty' thread into a sort of dedicated sh!tposting area that was only accessible to the more seasoned community members who wanted access just so they could freely troll the individual for a cheap laugh.
The reason I thought it would be better to capture the individual's accounts rather than banning, deleting or blocking them, was simply because it occurred to me that blocking, deleting or banning their accounts also provides them with definitive information, ie: they'd be informed whenever their latest sock accounts had been booted, therefore affording the individual accurate real-time intelligence thus likely allowing them a degree of confidence by the fact of being kept in the know.
So I basically denied them this.
