Hi Paul
Been there, done that and welcome messages sent out! 😨
We added a custom field to the user profile and added a code that identifies the culprits, which is then used in a rule to exclude them.
We use custom Profile fields quite a lot.
Hope that helps
Cheers
Stephen