Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
Captcha is like locking your car... There are still ways to get in, but it blocks the casual efforts.
Do you review upvote bots? The spam is an easily replaceable account, the coordinated army of upvote bots may be harder to track down.