This is a huge issue, indeed.

It's too easy for malicious actors to just create a trillion npubs, each posting the same spam message.

I have already experienced such attempt. Luckily it was "only" made out of ~50 spam accounts. Was really annoying though, because it used a lot of tags & obviously you have to block once per post, since every npub just posted one post, each....