Can't you use AI to block **** sites that use long user names?
Example: ***.space is one.
The real web site is embedded in the message.
I keep exceeding the 1,000 limit on blocked addresses but these are spoofs for the actual web site that is embedded in the message.