Identifying is a lost cause. She changes to common instances all the time, so we aren't going to defederate because of that.

IP address may or may not be possible, but iirc she changes it using residential proxies.

Best course of action is regex and disabling images in DMs.

For getting the IP you'd need the cooperation of the - afaik mostly were small - instances.

which instances are used for these spam accounts

is.hardlywork.ing? probably more.

which IP addresses are used for these spam accounts

There is a high probability that the spammer is using a VPN.