Now here's the thought
AAT logs the ip address of user signups and leaves it in a note (in bold). Now i was wondering, what's the chance of making it a link? Sort of like the way possible with the security exception |IP| option. i use that in combination with https://www.abuseipdb.com/report?ip= to generate a link to the abuseipdb to report the abuse. They also have an option i use to check for the region, now that geoip support has been removed. A countries IP can be checked through them via https://www.abuseipdb.com/check/<ip>
Now the thought is to make that ip an URL (which can be configured through a setting, where i'd leave up to you obviously), so one would be able to check the signup ip with a simple click on the IP and be directed to the IP checking site of their choice, to see if it's a valid signup. (In my case it wasn't, and the registration was simply removed).
Is this something you could consider adding? It's by no means geoblocking, simply checking which country an IP belongs too.