I've never understood why anti-scalpers just don't work backwards from shipping address. Are these scalpers all really keeping hundreds of actual physical addresses they can receive packages at? Like if you see the limited product has 100 orders going to the same building, or apartment, or whatever then flag it before it goes out. Limit PO Boxes, etc.
Sure they can find mules to buy+receive one and then sell to the scalper, but the more steps you put in the better. Same for the people scamming Sam's club by buying memberships, ordering limited items, then refunding the membership. Just lock orders to members older then >1yr and make sure it only ships to the actual physical address attached to the membership. Flag multiple memberships at the same address.
I've run a modest shipping op and the second I saw even a couple orders of the same product going to the same address I would halt it and do additional verification.