I've got the same problem, except that I also get attempted exploits (infected servers). It seems that your IP numbers all start out the same, and only the last octet varies. The chances are that the IP numbers are being pulled from a pool as needed, and then returned when not needed any more. This means that your miscreant might have different IP numbers each time (s)he signs on. Thus, I would block the whole range of IP numbers, 64.12.116.0 through 64.12.116.255. You run a slight risk of blocking out an innocent party, but it's probably worth it to save your bandwidth.

You may also want to use whois or traceroute (or tracert if you're using Windows) to find out whose server it is. You can get the owner's contact information from whois, and notify them of the problem. They may take steps to stop this from happening, depending on how ethical they are.

As for spoofing IP numbers, it's not likely that someone would go to that much bother, just to steal some photos. And I'm wondering why they have to keep scraping, if they've already got them. Sounds kind of dumb to me - or else, they've written a very rude bot.