Not necessarily a “quick fix” but i wonder if some thought has been added to “trust levels” yet.
Like, it probably shouldn’t be possible for someone to create an account, play no games, and send out 1000 invites to anything.
I’d recommend putting a daily cap on these kind of things, then raising it after an account completing some harder-to-fake task (like existing for X days)