Have you had any discussion with AG re IP banning (IP is the computer address they connect from). Perhaps a ban on a wider IP range may catch them unless they are smart enough to use a ghost IP where their original IP is masked by a bounce point. I mentioned this at the beginning of AG to try and verify the "location" of the new member using the IP number as a cross reference.