Paid relays make it cost something more than zero to post spam. If a spammer pays the fee and gets caught, they're back to generating a new npub and paying again. A delay between payment and access further impedes them. (not sure if that's typical, but it's a good idea)

I spot check the feed and IP blacklist on the nostr.rocket-tech.net free relay. That takes some time but seems to be very effective so far.

On my client, I target the biger relays (Snort, Damus, nost.mom, nos.lol, etc. for reach)