The Blacklist Module can write to .htaccess, and that would be the best way to handle this.
Block all referrer spam
Spammers know to find your referrer-page, even if you delete the template. To completely deny access, add this code to .htaccess:
There’s no real need to use mod_write - that may just add more overhead. A standard redirect will work:
Redirect 403 /index.php/site/
Or….
RewriteEngine On
RewriteRule ^index.php/site/referrers - [F]
NOTE: If you are using later versions of EE, change the rule to:
RewriteEngine On
RewriteRule ^index.php/site/referrers - [F]
If your spammers seem to be trying many different paths to find the referrer page, you might need to be all encompassing:
SetEnvIfNoCase Request_URI ".*site\/referrer.*" crappySpammers
order allow,deny
allow from all
deny from env=crappySpammers
Make sure you adjust the path if needed.