Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
The (simplified) way it works is it reads data from the public observer's API and check if ((total users > (totalPosts + totalComments) > susScore) as a "suspicious" community. "susScore" is configurable if you want to run your own instance of it.