The nice thing about persistent attackers is that their behavior is consistent and repeated, through which you can establish a pattern which then leads to an identity.
It's possible to be completely anonymous on the Internet, but the only way to do so is to avoid establishing a pattern, and avoid behavior that can be correlated, analyzed, and eventually distilled to find its common feature: you. This is how and why hackers get caught; they don't go silent.
So, if the common target is your forum, then you use the forum to find the common factors in the attack. You already have criminal behavior (child porn and death threats) which is enough to get the police actively involved. That helps with gathering data that would otherwise be inaccessible.
The next step is to start blocking off access routes that can't be traced. Assuming this doesn't adversely affect your other users, you can block TOR exit nodes, known anonymizing proxies and so on, until the only routes to your server left are ones that can be traced by the police.
Obviously this can affect your legitimate users, so you may want to only apply these restrictions for posting messages or new user registrations.
Next you start following up on leads; when you get relevant traffic, you check up on its origin. Did it come from a hacked webserver? If so, get in contact with the site's admin to report the intrusion and find out if they are keeping logs. Many admins will be more than willing to turn over logs of malicious actors, as they'll be just as mad as you are.
Sites like domaintools.com are surprisingly useful in determining who is involved with a given IP, what sites are hosted there, who the owner is or was, etc. A GeoIP lookup will help determine with more precision if IP addresses are physically located near each other.
Eventually you start to see patterns develop. You figure out that he only posts during a given 5 hour window (which probably corresponds to evening where he is), and while he relays his connection through other servers, the originating IP is typically coffee shops in a single city. He uses firefox on OSX. Little details which may come in handy.
The more information you have, the more information you can give to the police, the more likely they are to actually identify him.
Either that or he stops posting and the trail goes cold. Both ways, you win.