Rubbish!
A new email address and a new ip address, and delete their cookies, and straight back on, NOTHING in the admin panel that stops that, unless you start preventing new users from posting PM's and even then, the bot can just sit and wait, its not like they get bored, unless you start insisting on a certain postcount before you let PM's be sent (which isnt ideal but would do)