We have a number of required fields that are generated in client-side JS and not present in the underlying HTML. Our best guess based on logs is someone walking

We have a number of required fields that are generated in client-side JS and not present in the underlying HTML. Our best guess based on logs is someone walking through signup with devtools open, and then trying to replicate the requests. A day or two of reprieve whenever some funky change is made, like making the form element default to action="/a/url/that/bans/the/person" and then when JS loads and it detects more than 1000 pixels worth of mousemoves, replace the form action with the real signup endpoint. It's a standard forum software with some plugins, all <form> elements are CSRF protected with a random value, etc.