Thanks for your concern. I'm intending to do something like that, though I'm looking for a better way than being forced to move all existing users to a new user group. And to be honest, as it's only been two spam PMs (though sent to a lot of people) as far as I know and both from the same person (though not the same username/IP), it's not been my highest priority. I will take care of it though, and will definitely deal with it immediately if it happens again, but for now I'll rather wait 'til I find a better way to do it.
EDIT:

I shouldn't have said that obviously, there just was a new spam PM sent out and I don't have time to take care of setting things up now =) I will do what I can to stop the spammer though.