Yes, self-hosting. Using Stripe’s Radar for Fraud Teams on a fairly restrictive setting seems to have taken care of the problem for now, although iirc there is a cost associated with the service and I know it has blocked a couple of legit subscribers.
I’d have liked to experiment with confirmed email signup just to see what effect it had on the fraud attempts. Maybe in the future!
One thing I think has helped is that Ghost can now be configured to email me whenever someone signs up for any level of my newsletter, which I don’t think was the case at the time I originally posted. That gives me a bit of early warning if anything weird is going on.