OpenACS can ban users, but not IP-addresses. The only way to stop vandals is to require user approval before they can join which is a bit against the Wiki idea. I'll consider contributing some code.
Comparing XoWiki to MediaWiki (which is what we currently run), the latter one has functionality to revert changes directly from the recentchanges screen, and clicking on a username directly shows his contributions. This is (of course) no criticism against XoWiki, just an analysis what makes the latter one powerfull.