Generally when banning things it is better to do it in waves because it decouples the triggers you used to detect the bad action from the ban. You as the person doing the banning don't want to create a tight feedback loop that allows the bad actor to test out their various "attacks" against your banning system.