Know how the network clusters. Then when someone's reported, see how the clusters relate. Finding the source isn't too many hops. That'll help find the inciteful players -- the Milos, for example. It won't find people who organize in another medium, but are unrelated on Twitter. But second order analysis of who piles on connects them. Another mode of clustering.
In either case, be more suspicious based on (network) distance.
Then on the product design side: Make a way to separate users, and their first order follows. You report someone & computation checks it out as from a far cluster, and especially if it can find an inciting event? Just block those mentions. Like don't even let the tweet be posted. Gonna mention someone's username? Then you gotta not be a jackass.
It's reactive, mostly automated, but it takes reports seriously. It can eliminate the pile-on effect, especially if you run the algorithm proactively when someone's rate of mentions goes way up.
Also rate-limit non-conversational mentions b