You can, besides other measures, send abuse reports to ISP for any IP that is properly shown to have committed abuse (in an amount you could decide on). You could even make a tool that documents things like these and collects all reports at some location.