With all the spoofers appearing lately, how about a feature which sends random strings to servers every now and again then checks the reply. If it says it has the file (impossible) then "ban" that IP from the network.

eg. I send a query for "doifjuerhuifgg" to a server. If it replies "!!!doifjuerhuifgg.mp3" then we know it's a spammer. We can safely send every known virus/trojan to that address.

You could just add !!! to your filters and the bogus files would never show up in your search results. I have found a few of these folks have multiple IPs... and even though I filter each one as they are found.... the !!! filter seems to be the most effective - for this variation anyway.