Ben, how about striking IPs, instead of user since they can create new accounts?