Great feedback but yeah, big picture we're talking pretty small numbers.
The 10 (or so) spam accounts posted about 30 times. The longest lasting survived a weekend, after which I enabled manual account activation. From start to finish the spam issue lasted around 3 weeks. Eventually, I got rid of the forum altogether.
Alas I tried all the usual things, from the disavow tool to Webmaster forums and dozens of site changes, sadly nothing helped. My penalty felt back then and still appears to be, permanent.
It may help to know pre-penalty my rank was quite high, first page for most relevant search terms. (immediately after page 20 or lower, now around page 10).
Ironically, while the rank was nice to have I never actually did anything for it.
I simply built a fast, human first(!), site that inadvertently followed Google's site quality guidelines.
For example, my software generates web forms. One common growth tactic my competitors use is placing a link at the bottom of every form back to the parent site.
Me -- I never did that. I strongly felt that under no circumstance should the output of my software be used as a marketing tool. Sure it may harm growth, but it felt right, and that was enough for me.
Years after my penalty I read just that. Google frowns upon and may penalize sites for using such "widely distributed site links".
My focus was and always has been on user, so of course I'm the one who gets penalized lol.
Anyway, I think the most damning part of the process was not having a reasonable path for knowing what exactly happened and what I could do to help.
If I were crafting legislation that's where I'd start. I can't help that Google has the market-share it does, but it does mean we all have to play within their world.
All I ask is the rules, wherever they are, are fairly, justly, and evenly applied.