Thats one way, or monitoring the number PMs to different people at the same time.

For example, PM's sent to 5 people in one day containing a url, account locked for review due to suspicious activity.

You could do this with a simple cron job and a script with a few queries on the database. Query the PM timestamps count(*) group by date,userid. 5 in one day, update users table and lock the account.