We could have an account-only based solution for posting.

Like most solutions, email verification with password authentication, but with a twist. Should your email address be compromised, you will get a table upon first registration that you must keep to authorize a password reset and/or an email address change. You will then be challenged on a minimum of 3 positions in the table.

One could easily block all ip-addresses from posting except when a login token was found.

The login feature could even run alongside the normal board if that is too difficult to change and be implemented with NodeJS and MongoDB or SQLite.