How do you ban credentials if they're anonymous? Notice that if you can tell two requests are from the same person then you can do it across services by both of them pretending to be the same service.

Also, what happens to someone whose credentials are compromised? Are you going to ban the credentials of the victim rather than the perpetrator?