How many automated contact form promotions is too many? And then what do we do?

I received a fairly commercial mail this morning inviting me to use a Drupal extension that is not hosted on Drupal.org. I noticed that the "Hi ," username token was broken, so I assumed this person was doing it a lot and went looking in the db and found:

mysql> select count(1), from_unixtime(max(timestamp)), from_unixtime(min(timestamp)) from watchdog where type = 'mail' and location like 'https://www.drupal.org/user/%/contact' and uid = REDACTED;
+----------+-------------------------------+-------------------------------+
| count(1) | from_unixtime(max(timestamp)) | from_unixtime(min(timestamp)) |
+----------+-------------------------------+-------------------------------+
|       40 | 2015-08-12 14:05:07           | 2015-08-12 09:13:32           |
+----------+-------------------------------+-------------------------------+
1 row in set (0.00 sec)

mysql>

I think 40 contact form messages is the max possible.

Looking at the full watchdog for this individual the events follow a similar pattern of 10 contact form submissions, getting a 403 while trying to send another mail, pausing for a little over an hour, and then hitting 10 more pages.

I've removed the UID of the account doing this. Not sure what the appropriate way to handle this is.