Wikipedia:VOA

Most is done by anonymous users who do not log in. Such edits can be identified by the IP address in the edit history. Repeated vandalism can eventually lead to being blocked from editing. Usually, administrators would use features such as WHOIS and GeoIP to identify the location to which the IP address of the vandalizing editor is registered to. Generally, shared IP addresses or ranges are blocked for a longer period, especially those registered to schools or organizations (see the section entitled IP addresses below).

Accounts may also be created and used by vandals for certain types of disruptive edits that cannot be performed by unregistered users, such as those to highly targeted pages or page-move vandalism. This is one of the main reasons for requiring that an account be in order to perform these types of edits. While page protection is one means of reducing this possibility, such vandalism can still occur from new accounts, resulting in the general consensus that they should be blocked as soon as possible (see below).

Should you notice such activity from any registered user, revert the edit(s) if not already done before, and then check the user's contributions page to verify whether the other edits from the user are also evidence of vandalism. If this is the case, the account can be reported to Administrator intervention against vandalism as a "vandalism-only account".

Vandalism-only accounts are usually blocked indefinitely, sometimes without warning. The latter is typically the case if the username of the vandalizing account also violates the username policy.

...
Wikipedia