I think the way to go about detecting cheats server-side would be primarily driven by statistics. For example, to counter wallhacks one might track how often a player is already targeting an enemy before they become visible. Or to counter aimbots one could check for humanly impossible amounts of changes in the direction of mouse movement, somewhat similar to how the community found out a bunch of cheaters using slowmo in Trackmania.
Add in a reputation system that actually requires a good amount of playtime to be put into the highest tier of trust for matchmaking and I think one could have a pretty solid system that wouldn’t have to rely on client-side anticheat at all.
I believe there are some services, including some selfhosted ones, that allow you to quickly create (and later delete) unique aliases.
That said, I was surprised that these dictionary spam attacks don’t really happen all that much, at least based on my own experience. Most of the ambient drive-by spam my server receives targets email addresses belonging to domains I don’t even own. Blocking those and a few Sieve scripts gets rid of 99% of spam for me.
Interestingly, there was one time I received spam to a bogus address belonging to my own domain: A while back, one of my actual email addresses got leaked (thanks Sega) and a few months later that address got copied into another dataset but with a typo, which I assume was caused someone using OCR.