Here's the thing: they did do that. But the banned person would not move on, and continued to evade the ban and be a pile of misery for everyone involved. "Ban them and move on" is the sort of advice that works great until it doesn't.
If the troll was threatening life or some other crime, then fine do what you need to do. but the person is just essentially being annoying, that is not grounds to doxx someone. if they do not have the skills to keep out harmful users, thats their own fault, they should implement a captcha or some other tactic.
Changing the communications policy of the organization to only allow people a communications forum after they've been vetted might. That's a significant change that puts an OSS project at a severe disadvantage towards gathering support / interest. Also, it wouldn't even work in this situation; the actor in question proved willing to use every communications channel they could find to attack project volunteers.
its not my job to teach people how to police their own forums. nor is it the judicial systems job.
What crime? Be specific. You could perhaps suggest slander, incitement to violence, or invasion of privacy.
High bar to satisfy a case for any of those three. Consider everything a private investigator could do IRL if one retained their services to track down an unknown individual; in general, none of those actions are considered criminal (though the spied-upon person would certainly wish the PI wasn't tailing them).