One other possible solution client side that would slow him down is implement a privacy friendly recaptcha service on account creation. I wouldn't know how that would be done though or if it could be done on #nostr