Folks, I appreciate the suggestions.
I did analyze the spam: we get hit (or used to get hit) about once a week. Sometimes it was from a single account, sometimes from multiple accounts. Sometimes the posts we just a few a day, and other times they were blasted in.
I’ve considered a rate-based approach, and in a world where I had the time I’d love to investigate a queue-based, rate-limited approach. If I can eek out a spare hour or so, I’ll look into doing it. In the meantime, a quick (if obnoxious) captcha seems to have stopped the problem for now.
