IP address could be used.

Blocking an IP address is not possible because that would block many innocent Steemians. Due to the shortage of IPv4 addresses many ISPs outside America use Carrier-grade NAT (CGN) for their residential customers. Customers with ISPs using CGN) share the same IPv4 address as many other customers. Blocking an IPv4 address will block all Steemians sharing the same IPv4 address, not only Malcolm.

But if someone is willing to go on a VPN

Just one click in your Opera browser and you are on VPN (5 countries to choose between). As simple as clicking on a link. No subscription or account is needed - free of charge. "Malcolm" loves the Opera browser. :-)

I understand your post and I'm sure Steemit Inc. will find a solution if/when harassment becomes a problem, but blocking IP addresses is not a solution.

Steemit is an open platform where you even can see the wallets of other members and it's difficult to "hide".