By reading the question, it seems like your solutions are "if this then do this". I would expect you guys to have hidden reputation systems (on IP address, email, users, ...) that only administrators know the rule/numbers. A sort of "bad-user-reputation" system.
If the user was from a bad IP address, add +5 to "bad-user-reputation"If 5 users were just created from a new email domain, add +5
If they didn't read the FAQ, add +2
If they came on the site from a Google search, add -2
...
If that user has a reputation of 20, then this is a user to watch.
You should even have a reputation system on IP address. If too many people ask bad questions from a specific IP address, then that IP address gets a bad reputation. It doesn't mean that someone posting from this IP address is 100% bad; it just mean that there is a x% change that the user is bad.