An abuser will use a VPN to counter an IP. Is it possible to use the IMEI? A person can have multiple devices but usually a person is single to use these devices. So IP + IMEI could be an account.
However, there is still the GDPR. Several law firms are studying the possibility of litigating large corporations and blockchains. In the case of blockchains, it will be miners and witnesses who will be prosecuted.
From my understanding an SMT would have free range to work this out in the way they see best suited for them.
There is some socio-economic factors to the game as well. Believe it or not, in Steem's white paper it predicts spam and abuse and it says that some of it is necessary to create the network effect.
Now that sounds counter intuitive, at least on the surface. But, when I think about the fact that no society has gotten ridden of negative behaviors, at least not entirely.
I will admit, I'm not aware of the sweet spot, but I'm convinced it does exist. Maybe if we cut down with spam/abuse to a third of what we have today. Maybe, that's optimal...