Add velocity controls for the IP address and you'll get a thousand sign ups from a thousand IPs. Limit it by device and you'll see a thousand devices. Flag the images using a perceptual hash and the images will come back superimposed on random pictures of food.
At some point you find that your accounts are now traded as a commodity on underground markets at various prices by teams that specialize in creating accounts, aging them and selling them for x cents. Add enough restrictions to new accounts and you'll find existing shops being taken over and flooded with listings.
And do all of this while still having an "effortless" signup experience for new legitimate vendors.
Routinely (i.e. daily) I see activity that may involve 500+ unique IPs and 2000-4000 attempts. The type of activity that I see isn't close to what would be considered an extreme-worst case scenario in the industry.
Assuming the right economic incentives these groups are over time able to duplicate about any behavior that would be seen by a typical customer. For example, they can effectively remote desktop into a device and create a sleeper account and then come back to the exact same device a week later once the probation period has expired and execute a larger attack.
Also it is hard to fully understand that markets where labor isn't scarce fundamentally organize themselves differently. For example one recent attack that I'd see involved multiple attempts from multiple IP addresses and multiple devices all within seconds of each other and using the same credit card for registration. For a while I marveled at the technical skills that would be required to orchestrate such an attack until I realized that it likely was likely a dozen people in a room sharing the same credit card number and launching the attack in a coordinated fashion. Low tech, but extremely effective when labor is cheap.