You’d think there’d be a programmatic way to stop this. Like after the third comment in a span of three minutes, require password re-entry. Obviously don’t publish the method for determining how to require password verification but it wouldn’t be too tricky.
The same concept could be applied to poker accounts that are normally tag but suddenly sit at stakes 10x what the account normally plays at and the account starts throwing money around… just lock the account automatically. It’s like 99%+ likely to be a hacked account joyriding.