What they need to do is, any suspicious gil activity found, or suspicious code activity, straight up permanently ban the accounts in question (every last one of them), unless the account owners can prove beyond ALL doublt (not just reasonable doubt) that the actions were legit. This ban will all the payment methods used by any member (so Steam ID, card details, etc) that was banned, so they can't simply register a new account with that card info. They'd have to go so far as to adopt a completely new identity IRL in order to be able to play again. That would definitely curb most of it.