Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the websit

Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the website. If they still break that, then probably fines+damages of some kind. But you know, something. The other extreme which some people are advocating "let the users do whatever the hell they want and it's your own fault if they keep spoofing fb accounts/phone numbers and creating new accounts" I find pretty bad and tone-deaf; it gives carte blanche to bad behavior. Any malicious user who is set on messing with you becomes a full-time job to deal with. Most people who run some kind of B2C website have run into this and once you hit 1M+ users you are bound to be dealing with a handful of those at any one time.