So, for the last week or so, I have seen what is apparently a group of people abusing the referral system, referring 200+ people per day. My guess is that they turn around and use those points right away to download data for free.
I have been working the referrals hard for the last two years. Only one time have I seen anyone legitimately pick up more than 25 referrals in one day.
My suggestion is this. Set up the system to automatically lock any user who refers more than 20 people per day. Let them still earn referral points, in case they are legitimate, but don't let them spend those points that same day. Review the locks when you come in, and unlock the members who may have been locked but are legitimate.
You could also not add points earned by referral for at least 24 hours, or the next business day. The abusers work at night and on the weekends, knowing that regular staff isn't there to stop them.
Since these people keep coming back again and again, Jigsaw has not been able to deter them. Unless this is a purely spiteful attack, the only reason they come back is to gain points to use to download data, which they likely sell on the open market. Keeping them from being able to gain will soon enough stop their abuse.