[cbf66]

It was from about 10 accounts. Which we suspended. But it appears that they created new accounts overnight (daytime in China). arXiv is not well-equipped to play whack-a-mole.

And 10 accounts using 100 different IP addresses, would seem unlikely for an innocent project. And creating new accounts ...

[deathlock]

Can you set a restriction so that each user cannot change the email if it has already been changed during the last hour/day? In this way you won't need to ban IPs while still allowing legitimate users to change their emails or to create new accounts.