Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
The issue is that it could still be abused against small instances.
For example, I had a bit less than 10 bots trying to signup to my instance today (I had registration with approval on) and those account are reported as instance users even though I refused their registration. Because of this my comment/post ratio per user got a big hit with me being unable to do anything (other than delete those accounts directly from the db).
So even if you don't allow spam accounts to get into your instance, you can easily get blacklisted from that list because creating a few dozen thousands account registration requests isn't that hard even against an instance protected by captcha.
Comment / post ratio is useless as well for this though.
Looks like I pretty busy, totally real server by the aforementioned metric