Thank you for adding this to your todo list, I appreciate that, the big issue for me is because this all connects with our Game Server, and we handle bans from their account on IPB, ofcourse I can just implement an IP Ban system on the game end of things, but this isn't good practice when it comes to unbanning that players IP.
As I mentioned above, banning their IP from cloudflare wouldn't make a difference in my specific case, as the API which isn't accessed through the website, but through our game server which is hosted on a separate server. The user never needs to access the website for registering. Of course I could add extra steps to the sign up process, like making the user confirm their email, but I prefer not to do this, which makes the sign up process easier for the user.