I feel like "just issue a ban" trivializes the complexity of this: banning one account does basically nothing, and they can just create a new account. Multiple people often have the same name, so you can't just ban everyone with that name. It's trivial to take new pictures, etc..

That leaves, what, asking a private company to do facial recognition scans on all new users? Requiring them to present official government ID ala the recent EU laws?