No way to fully block a remote user on the server-level

It seems that "deactivate" does nothing, and if you delete the remote account it'll just come right back with the next activity.