You could try browser fingerprinting[1] for identification and as a second measure (if the spam is coming from the same machine) at least you can prevent them creating further posts.

[1] https://github.com/Valve/fingerprintjs2