Penalizing consecutive withdraws seems like it would work without collateral damage. That's basically the entire problem anyway, as people might have a legitimate reason to withdraw once and rejoin in a few minutes, but not to do it 20 times in 60 seconds as we've seen.