Or, they could just look for odd behaviour.

Someone has sent out a shout 150 times in the last 60 seconds. Even if they aren't RMT they deserve to have a temp removal of their shout privileges.

Someone has sent out a tell to 200 different people in the last 60 seconds. They can no longer /tell for some amount of time.