In short, you try to make it not worth the cyberstalker's (or troll, spammer, etc.) while. No matter how many protections you put up, if you make your service available to the public, people will be able to register and harass other users. So, firstly you make it harder for them to do this (to a degree). Some methods include:

1. Verified accounts - e.g. a confirmation email.

2. Social media (Twitter, Facebook, etc.) - obvious caveat being, some people don't have them, or won't want to sign up with them, etc.

Then, you make it harder for the cyberstalker to determine they've been banned. "Hellbanning" is a good example of this - you ban the user, but don't notify them. Everyone else just doesn't see the comment. There are variations, but the idea is to make it harder for the person on the other end of the screen to determine when to switch accounts.

Thirdly, you implement some sort of user control. For example, an "ignore" button - press this, and suddenly that user's comments aren't visible to you any more. Without notifying them, of course. Alternatively, let the project owner hellban/ignore any user from their project.

And then there's the other stuff - community moderation like Reddit and HN, automatic spam filtering, disallowing registrations from throwaway emails like Mailinator, and other stuff like that.

No matter what they implement, "please go away because you're being stalked" is NOT the right choice. There are technical solutions to this kind of thing, and if they're not perfect, they're certainly better than nothing. And at the end of the day, it's not about being perfect, it's about making the person that's sitting on the other end of the screen not want to spend the time to harass you, or post spam, or troll, or whatever else.

Banning IPs works well enough even for vastly bigger sites like Wikipedia. Combined with an open proxy checker, it's surprisingly effective.

It's not perfect, but for ANY site of sufficient size with unmoderated user content, this problem eventually has to be dealt with. Threatening to ban the victims is not a solution.

Kickstarter earns 5% from every single successful project: they can afford putting some effort into moderation and protecting their customers.

Turning off comments would have had the same effect. You can't spam if you can't speak. A project update explaining why comments are no longer available, and emailing the project creator to start a conversation, would be good next steps.

You also can't post a comment if you don't have an account, so banning the account would be a reasonable stopgap measure; this step wasn't mentioned in the blog post. If they're flooding accounts, then ban the IP. If they start switching IPs, then you can start making excuses for Kickstarter.

It's important to remember that deterrents that can be circumvented is not the same things as pointless deterrents.

That's sort of like saying that security by obscurity is pointless -- certainly it's NOT pointless, and banning IPs (like security by obscurity) will work in many cases, and should not be ignored as techniques.

They aren't the solution, but can be part of a multi-pronged approach.

For trolls/stalkers that know how to get past an IP ban, I do like hellbanning, accompanied with a strict written policy of "don't feed the trolls".