Yes, they do need to address repeat infringers in some capacity. The undefined terms "reasonable" and "appropriate circumstances" are used which is pretty grey.
https://www.law.cornell.edu/uscode/text/17/512
"has adopted and reasonably implemented, and informs subscribers and account holders of the service provider’s system or network of, a policy that provides for the termination in appropriate circumstances of subscribers and account holders of the service provider’s system or network who are repeat infringers;"
This in no way needs to reflect the current method of copyright strikes. They could keep a hidden database. They could have it be 4 or 5 strikes instead of 3. They could remove accounts immediately on the second infringement. Instead, they put in place a very specific tiered punishment system with a rolling 6 month timer that removes site features along with a 3 strike to termination structure. They could easily determine that 3 months instead of 6 is enough for someone to have learned their lesson. Or 12 months instead.
Saying they don't have the legal authority because it is the claimant that issues the strike is a nonsensical position. YouTube removes strikes all the time. If it was the claimant who issues the strike, YouTube would need a court order to reverse it in the event of a false claim. It is an internal system which has room for appeal and YouTube themselves are the ultimate arbiters of how it works and what it does.