Whether or not the blogbotters (see post below) have broken any laws for which they can and will be held accountable, the face of Xanga will likely change in response.

To interrupt their efforts, you have to understand that a bot relies upon scripts and, once launched, an almost total non-reliance on human intervention in order to perform repetitive tasks rapidly.  In this case: auto-generated blog signups, random auto-commenting, and occasional targeted auto-commenting. 

If you can locate the source IP of the bot server(s), you can immediately block them at your domain.  But then the bot server(s) may switch to new IP addresses-especially easy if it is a coordinated attack-and you will have to respond by blocking again. 

In this Xanga case, however, the bot(s) seem to be hiding behind internet anonymizers that shield information about the source IPs. Xanga could block the anonymizers, if it could discern by server logs, who they are.  Or Xanga could just block a list of 'known' offensive anonymizers as an act of hopeful preemption. But determined trollers (the blogbot writers) will always find another anonymizer service out there somewhere-they're as prolific as free email services on the Net.  Hence, blocking is problematic, reaction by shutting down discovered botted-sites is like putting out a house fire with a garden hose, and prevention becomes the key to success.

 What can Xanga do to prevent or interrupt the activity of troller's bots?

CAPTCHA is a technique widely used by many internet services to stop bots in their tracks. It is an acronym for "completely automated public Turing test to tell computers and humans apart". 

What Xanga can do is implement a CAPTCHA at time of sign-up.  If that proves inadequate (for example, let's say that trollers have been laying the groundwork for a long time and have already registered hundred of thousands of blog names that they have yet to release), then another CAPTCHA somewhere in the commenting process may be required.

Trollers hate CAPTCHAS because they break the automated bot process by requiring human interaction.  But beyond the laboriousness of interaction, I'll bet that these trollers find personal reciprocation with the target of their attack supremely odious to themselves. They pride themselves ultimately on having automated processes and intelligent machines defeat the target and establish their reputations.  It is precisely the persona-borne (in this case, blog-borne) impersonality of it all that gets them off.  Force them to become persons, to be real and hands-on, and watch them back off real fast.