Ban IP should work for wildcards as well as domains names. I have one kid ordering through an anon proxy who keeps changing his IP, just the last octet, and keeps getting through, even though I have banned the whole domain and IP block.
Also the spam control settings do not seem to work with wildcards or do any matching on the term. This is so rudimentary, not sure why it doesn't work. I put in viagra, yet I still am getting support tickets with this in the topic and body. Somehow spam-assassin doesn't block these but it blocks my emails I send to customers, amazing!