We have a form on a commercial website which has been abused (but only once or twice) by someone from a particular IP address.

A colleague wants to blacklist that IP address from the website.

Seems to me that's overkill, and that there's a risk that genuine customers sharing that same IP address would be blacklisted too.

I suppose a big part of my question is how many people might be sharing that same IP address and could be affected by our blacklist. I suspect that's a "how long's a piece of string" question but some ballpark answer would be really helpful.

We're in the UK if that's significant.