@Null, have you given any thought about using perceptual hashing? Idea being when you ban a user for posting an inappropriate image, you (i.e. the forum software) can first grab its phash and store it in a blacklist (then delete the image, that way you're not accumulating CSAM, just hashes), and then whenever someone uploads an attachment, grab its phash and quickly scan against the blacklist. Matches (rather, "very close proximity") would auto-trigger account suspensions without notice (perceptual hashing is surprisingly accurate -- it's what the feds use for their semi-publicly accessible "CSAM matching database"). False positives are extraordinarily rare and presumably a quick email exchange could clear them up.
There's at least
one PHP implementation of perceptual hashing, but there's a shit ton of other options too. This one produces 8-byte hashes, meaning a table lookup on that for a match would be fucking fast even with a hundreds of thousands of rows. The short length of the hash is a feature, not a limitation. You don't want every image to have a unique signature; the purpose here is to find visually identical images while allowing for changes in resolution, color balance, watermarks (or absence thereof), compression artifacts, etc.
Obviously integrating this would require a new DB table (though I'd argue just ID and hash would be enough; it doesn't particularly matter who posts matches for whatever hash, and that could be noted in the ban message anyway), a change to integrate the phash function for all attachments (no need to save them on success BTW; just the blacklist is fine) to catch and block/auto-ban matches, and a change to the ban feature to enable it to phash a newly-discovered "naughty" attachment to add to the blacklist.
It's not a perfect solution, but it
would require additional effort for our little pervert pedo to weasel past it. He'd have to constantly post different images (keeping track of which ones have caught bans already) and potentially even start editing existing ones to get past the phash match. He probably does have thousands of different images (pedos always do) but the upshot here is nobody else could ever re-use any of them if they ever decide to play copycat.