sign up for the resellers, insert a random id canary into your requests, trace them back on your server to tie it to an account

find fingerprints / signatures of the accounts being used. ban all of them.

eventually build an ml based system that detects these at signup

reinforce with more data. loop forever, etc.