Easy: solve 5 captchas (all known captchas of course, not 2 knowns and 3 unknowns) a day for 2 days and you get authorized again. Next violation, solve 5 captchas per day for a week. Next one, 5 per day for a month.
That could work indeed. Annoying but necessary. Tho what does one do about real bots - people in spam farms that would manually
login, post and logout.