Yeah. Banning by IP, username or email address just doesn't work unless you've got some way of positively identifying somebody. Not unless you're willing to enforce really broad bans which are quite likely to affect other legitimate users.

Banning by IP address/subnet used to be fairly effective until ISPs started to use DHCP with really large dialup/ADSL pools that are owned by a larger company.

- Trevor