The only thing I'd note is to be careful with your issue #2, because this sounds like it could break with autofill. Some autofill implementations may fill invisible fields (this has actually been an attack vector to steal personal info), so blocking the IP because an invisible field labeled "email" has been filled could hit users too.
Otherwise, 100% agree!