The only thing I’d note is to be careful with your issue #2, because this sounds like it could break with autofill. Some autofill implementations may fill invisible fields (this has actually been an attack vector to steal personal info), so blocking the IP because an invisible field labeled “email” has been filled could hit users too. Otherwise, 100% agree!
I love that you had such an annoying update experience that you went ahead and created 2 memes about it and postet into a total of 4 communities, only to vent your frustration. Keep going, this is great!