The Computer Fraud and Abuse Act in the us (18 USC 1030) criminalizes unauthorized access to computers. The courts have viewed the statute narrowly, so that violation of Terms of Service when a person is authorized to access does not create "unauthorized access". What you are talking about is probably actual unauthorized access. Breaking into a computer system can be punished criminally, and the law also alows you to maintain a civil action to get an injunction and obtain compensatory damages. You hire an attorney and sue, in the latter case. You try to interest the federal government in the former case. It is not clear whether the government would consider such a case to be important enough to pursue criminal charges (assuming that the intruder is an annoyance but does not steal financial records or upload child porn). This page has a list of relevant cases.
The case of Craigslist v. 3taps, Inc (analysis here) is on point. Craigslist exercised its "power to revoke, on a case-by-case basis, the general permission it granted to the public to access the information on its website", so 3taps was IP-banned for engaging in prohibited behavior, and responded by changing IP address. The court concludes that although Craigslist has "authorized" the world to access their website, that access can be and was revoked. It should be noted that Craigslist also sent a cease-and-desist letter, a fact which is not ignored in the decision. Thus,
In contrast, the average person does not use “anonymous proxies” to
bypass an IP block set up to enforce a banning communicated via
personally-addressed cease-and-desist letter.
The decision does not explicitly say that a personal cease and desist letter is required to enforce a ban, but it does not deny that proposition either, so the safest conduct for the site-operator is to also send a letter, lest they become the case that nails down the importance of the letter.