My apologies that Discourse allowed numerous spam posts through this morning. The spambot must have known exactly how to sidestep the automatic checks (such as “posting too fast”—ie, pasting a long post in rather than typing as most people would do).
I’ve deleted the spam and the spambot accounts, and I’ve at least temporarily increased the protection by requiring that the first post from all new users be approved by a moderator. Until that first post is approved, no other posts are approved either, so it will effectively block spammers.
The downside is that legitimate new users will have to wait until a moderator sees and approves their post, so I’d prefer not to leave this protection level on all the time. But we’ll see if it feels necessary in the longer term.