Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
Haven't you heard of the "Swiss cheese" model of security?
The best way to ensure your server is protected is to unplug it from the Internet and put it in an EMF-shielded Faraday cage.
There's always a tradeoff between security, usability and cost.
captchas can be defeated, but that doesn't mean they're useless - they increase the level of friction required to automate malicious activity. Maybe not a lot, but along with other measures, it may make it tricky enough to circumvent that it discourages a good percentage of bot spammers.