I think a reasonable solution here would be to only automate reported abuse with a registered account, and only automate a certain number per account per time.

I think a reasonable solution here would be to only automate reported abuse with a registered account, and only automate a certain number per account per time. it wouldn't be insurmountable to abuse, but you push the barrier for abuse over the average troll's willingness. not a perfect solution, but would help cover a sizeable volume of this kind of phishing attacks.