This new spammer has been flagged, so will not be able to access the site again. Also, after the last spammer created a new account as soon as I flagged their first one, I installed some code that allows me to see what IP address they are logging in from. The IP address of this newest spammer has now been blocked, which should prevent them from creating another account on our site.
Apart from blocking the IPs of known spammers, the options for preventing future spam attacks are few and imperfect. I can take measures to make creating an account more difficult, but that will make it more difficult for legitimate users as well.
Also, I could install software that adds a “friends” feature to everyone’s account. You could then send friend requests to other users (very similar to facebook), and then people could only send PMs to their “friends.” Apparently this has (mostly) worked for some other websites that have experienced the same spam issue that we’ve been having. But it would be a bit of hassle for everyone to send and accept friend requests to/from everyone they want to message. Plus, it wouldn’t prevent a spammer from sending out hundreds of friend requests, but at least those don’t generate email notifications.