I haven't had spam problems since the big spam era back a few months ago. Clients have at least these options:
1) banning pubkeys -- if a pubkey becomes a spammer, ban it
2) rejecting new pubkeys -- reject events from pubkeys you have never seen before
3) require a social connection -- block replies from people with no connections in your social graph
4) make the relays do the work -- block replies from relays that aren't known to be good spam filterers
5) block by content -- use some email-like bayesian spam filtering that bases it's decision on the content
6) require pow -- on the message, or on the pubkey
Relays can also use IP address reputation, requiring payment, or just human eyes and decision making.
