Hi,I run an email forwarding service and It comes to my attention that my app is being use in an account take over attempts. Basically they registered expired domain, setup email forwards to receive email.Due to my app have some features such as bulk import domains, auto config cloudflare DNS, and receiving email through API, it make it super easier and fast for them to receive emails. This ends up attract many of them to my services.I cannot keep deleting accounts. They just keep coming up. They also looks like have all kind of automated selenium or so I think to do spin up and run behind VPN. I cannot block by IP or country since they all use VPN. They also use steal credit card to pay for my service which lead to me losing money and cause us a net negative.I don't know what is an effective way to defend from those attacker? Any idea?