On "your forum" it is none of their business,and that is your prerogative. On my forum I usually make it everyone's business, and that is my prerogative.
Your making a lot of unnecessary work for yourself, but again your prerogative. On my forum, rude behavior, spam, harassment draws a ban for first offense. Whether permanent or time period is tailored to each situation. Warning points or verbal warnings point you out as a softie IMHO.
I was a blogger for nearly 10 years before I bought IP.Board. When I saw IP.Blog I also bought that thinking it was... well blogging software. I was livid when I found out what I bought was not bogging software at all.
If someone produces tires, they don't sell them carberators. Either compete in the blogging market with IP.Blog as blogging software, or don't call it a blog. Which it isn't, it is a fancy page builder with comments.
IP.Blog will compete with real blogging software ( like WordPress, MovableType etc ) when it can be sold and run as a standalone application without the IP.Board core. As it stands, it is a blog in name only.
Until then, IP.Blog will not be taken seriously be avid bloggers. I have IP.Blog, but don't use it in favor of MovableType ( not as popular but better than Wordpress ).
Make IP.Blog usable with IP.Board/IP.Content, but also as a standalone blogging software and you will get buyers not only from IP.Board owners but many serious bloggers who are not interested in a forum.
I run three sites. Two have 3.4.2 and one has 2.3.6. There are security issues with 2.3.6, but it is a mole hill, not the mountain it is being blown into in this thread. Nor do I expect security updates for it.