If we use the “Email domains to block” option from the form settings, what does the blocked user see if they try to fill out the form? Does the form tell them they’re blocked? If so, that provides them an easy way to get around it by using a different email address.