Most effective: If you have downloaded and installed NewsProxy/Nfilter, and if your news server will provide the proxy with all headers (not just “From” and “Subject”), target his IP address:
NNTP-Posting-Host: *.dialup.cornell.edu
Although the first section, represented by the asterisk, may be variable, the remainder if fairly reliable. Despite any changes he makes to his user ID or fake email address, the above header will invariably show up in his posts.
Less effective: Target his user ID rather than his fake email addresses. He is very adept at coming up with minor variations and multiple permutations of his “bu$h-hatred” fake email addresses in order to evade filters, but he wants everyone to know that the messages come from him, so he will invariably posts under the following user IDs:
Hank
Henry