I've found that multiple web application firewalls help too.
(and this is a technical solution that involves changing DNS records)
Free (or paid) Cloudflare (and WP plugin) => WP installation and free (or paid) Wordfence plugin.
Both Cloudflare and Wordfence are tracking spammers on their network of installed sites. They both want you to pay for faster recognition, and you totally should if you need it, but using both on the free plans can help lots.
The Internet is big and lots of magic happens outside of what s2 (or WP) can do on its own. Sometimes it's best to stop spammers before they even get there.