Is a mere warning or blacklist sufficient for a user attempting to abuse or should there be a stiffer penalty?

Given how often "rinse and repeat" is literally utilized, it would be wiser to include whitelists in the mix. Then again, with recent examples we have seen, some people take the time to infiltrate the ranks in order to benefit from the votes.

Realistic me says that perpetual whack-a-mole is in our future.

It will never be resolved. Nobody will bother to hire "curators" to check out bids as they are sent. Everything that is done on the platform to combat abuse is reactionary and passive. There are very few active approaches to prevent them from happening.