> And is the necessary escalation when online-only tools have failed and the attacker will not relent

other tools are available (captcha, TLS fingerprinting, browser fingerprinting). if the moderator is not using these, its not a free permission for them to doxx someone.