It started out harmless enough: A registered user tried to submit a spam post. What I do in such a case is block the user's account. It had a yahoo.com address and the user had actually gone through the trouble of uploading a user photo - which featured the photo of a doctor and the words "online pharmacy". Nice one.
A while later, another registered user tried to edit his user profile and stuff it with the usual pharmacy spam keywords. Good thing we run user profiles through the spam filter ...
That "new" user, however, came from the same IP address as our previous guest. And that's when I noticed a whole bunch of new accounts, all using email addresses with the domain name kinglibrary.net. Well, guess what happened to those accounts. And into the blacklist with that domain name.
This multiple personality spammer came from one IP address, 18.104.22.168 which belongs to RuSat Ltd. in Moscow, Russia.
kinglibrary.net is registered with joker.com to a Devon Hillard in Shoreline, WA. Not sure if that is a fake address. The website shows a default page of Joker.
Interestingly enough, a Google search for kinglibrary.net brings up firstname.lastname@example.org's personal blog. This is the sort of email addresses our spammer friend here uses. Nothing on that "blog", other than a test post from October 28, though.
And there are more accounts on all sorts of free services with email addresses of the same form, as well as posts on various Google groups. I guess it's save to say to delete any such user - and their posts - on sight.