I feel like having to do moderation on the instance level is just not a good idea, because it just leads to scenarios like this. Unless an instance was just set up to send spam, in which case blocking it site-wide is obviously the best thing to do, you're always going to cut off actual people who post from there.
At least on Lemmy, moderation can also be done on the community level, which actually have a topic they can enforce.

The information returned by whois depends on the registry. For example, most registries for European TLDs basically just show whether the domain is registered (I say “most” because I'm not sure whether it's actually all or if there are exceptions, but I know .de is like this). In that case, there aren't even “whois privacy” services available from registrars. For TLDs from other countries or gTLDs, this might vary.
In either case, do note what the other comment says. Whois is not the only way to identify who runs a service.
If you didn't pay for whois privacy, it would most likely return your actual name, email address, phone number, and home address instead. “Whois privacy” just means your registrar inserts their information into these fields instead, and forwards any mail they might get to you.