It sounded like he's using browser automation. So how about for new users, randomize the location, text, and button name of the Post Reply/New Post buttons? Take a few words that mean the same thing as "Post Reply", randomize them and the button's location, and add some random text at the end for each page a probationary user sees.
Assuming his tools can be trained to just bypass a normal submit button, you'd need to have multiple
<button type=submit> buttons on a page, hidden so normal users don't see them, and one displayed. The server would know which random string is the real one, and would only accept forms submitted with that action.
Instead of:
Ver archivo adjunto 8135646
Something that generates:
Ver archivo adjunto 8135735
Ideally you'd have some way to detect when a user tries to submit a form using the standard button when it doesn't exist, or when they pass invalid form parameters. That would flag the user as a potential bot to quarantine. Looking at the screen and reading it could solve it manually, but that would take much more time (and expense if paying jeets).
I've only ever used professional browser automation tools, so I'm not sure what the skids are using or how they work. But I think this should break most of them, and prevent immediate solving from AI asked to submit a form.