2. Identify bad blocks of IPs. If it's a datacenter, someone is probably running spamming software on a dedicated server or VPS. Maybe get your hands on some of those open proxy lists that are floating around.
3. Use your data to prune bad accounts, throttle or block creation of new ones, etc.
A word of warning: between forged IPs, compromised systems, and formerly hostile IP space given to new owners, an IP blacklist will eventually hit legitimate customers. I speak from experience on this since I had the same bright idea.
You are right about the blacklist, however, it's very unlikely you will have legitimate users coming from datacenter IPs. I've used this trick to prune hundreds/thousands of bad accounts in a couple of forums. You need to be careful with it, but I think it's a worthwhile method.
1. Whois IP address of spam accounts.
2. Identify bad blocks of IPs. If it's a datacenter, someone is probably running spamming software on a dedicated server or VPS. Maybe get your hands on some of those open proxy lists that are floating around.
3. Use your data to prune bad accounts, throttle or block creation of new ones, etc.