A more extreme approach that may or may not work for you is to make the community invite-only. Track the network of invites and shadow-ban linked accounts when

A more extreme approach that may or may not work for you is to make the community invite-only. Track the network of invites and shadow-ban linked accounts when you detect the spammer popping up. The spammer will eventually run out of invitees. You can combine this with "no invitation required" short periods, where you make changes to the signup flow, spam detection, etc. and make the window short enough for the spammer to not have the time to adjust their bots.