It was from about 10 accounts. Which we suspended. But it appears that they created new accounts overnight (daytime in China). arXiv is not well-equipped to play whack-a-mole.
And 10 accounts using 100 different IP addresses, would seem unlikely for an innocent project. And creating new accounts ...
Can you set a restriction so that each user cannot change the email if it has already been changed during the last hour/day? In this way you won't need to ban IPs while still allowing legitimate users to change their emails or to create new accounts.
They would also have to be in the same class and all running their code at the same time.
Indira Gandhi National Open University has over 4 million students, and in China about 40% of university students are in STEM. It's certainly not impossible that this is coming from a single institution.
"poorly written" could easily remove the "engineering" qualifier.