I think the easiest and effective solution is to disable your search on your wordpress website, by doing this, the spammer can't conduct any operation, it is good for your website.
It seems funny.
Actually here I would suggest that you add a NOINDEX rule to your robot.txt file, and tell Google...