That primarily works if you can shadow ban the account. Otherwise the spam is still negatively impacting the community (ex. By polluting search results).
If you make them create a new account each time you remove a package, how does that help you find or remove pollution going forward? It seems to work in the moment, but if you have no plan to change the system the resulting equilibrium is worse than if you can identify a connection between packages from the same spammer.