You know, I had a thought on SK2 a few minutes ago.
I said to myself, "Self, if SK2 can run a filter on comment text, why couldn't it run the same filter on a posts text?"
Here's what I'm getting at.
Sploggers come in, hit a few posts, and leave. Sometimes it's simply a single post.
Later they may try to come back through xmlrpc to their "site", but that's a whole different ballgame. Usually they've been blocked by then.
So, back to my thought.
Why couldn't there be an individual site setting that is a value. It's value is increased with each post (through a do_action call).
Then SK2 would check this variable, and say if it's less than 5, it would run the post content through its filter. If this value is grater than 5, nothing happens. Note, this variable is only updated on a successful publish.
If it hits, then the post status may not be set to published, and a site admin is notified.
This way, you can double check the information, and if legit you can lift the restriction. Or something to that effect.
If it's not, then you can remove the offending site without incident or content ever being pushed out.
Legitimate posts, just like legitimate comments, should pass through without issue.
Or, another possible idea would be to set a post-id variable as above, and then modify the ping function so that posts with an id less than 5 wouldn't be sent through the ping channel.
Then, if you monitor your sitewide feed, you can take action. The content might get published, but at least the whole world isn't notified about it.
Hmmm... I wonder...