2
200 PM messages in a day? Spambot for sure.
If it were me, I'd delete the accounts and ban the email address/domain to prevent re-registration.
I'd also make sure that users are not allowed to change their email address - this will allow you to see the addresses/domains used at the time of account registration.