Today some jerk joined the Arqade group on Steam and started spamming people with links to a lookalike phishing site. You know, like this but with "store.steampowered.com" instead of "twitter.com":
Image from the OpenDNS Phishing quiz. Hint: this one is a phish.
Now, I've kicked him from the group and flagged his account, but... it's a public group! Anybody can join. We'd rather not change that and still keep him out.
Is kicking sufficient? What else can I do?