All law enforcement has to do is to purchase something in response and follow the flow of money from the credit card to seller and intermediate banks.

The traditional rule was that banks were supposed to know their customers.  This rule arose because if a bank's customer did something improper the bank stood a risk of being stuck with the loss.  If a bank cashed a forged check, the bank took the loss if it couldn't find the customer.

There is another principle that if you gain something by an unlawful manner, you have to return what you gained.

It is no stretch to require a bank to return funds a customer of it or of a correspondent bank down the chain illegally obtained with spam, as they do when they cash a forged check.

Once some banks, foreign or domestic, started taking losses on reversed spam charges, they would stop doing business with the spammers.

Spammers depend on bank money flow.  They don't operate with cash.  The government can easily control that,

In fact, the government is doing exactly that with its sanctions against banks that do business with North Korea and alleged terrorists.