What spam protections do you have enabled, trusted relay operator?
Discussion
I wrote and run https://github.com/damus-io/noteguard which does ip ratelimiting. You can only post 6 notes a minute, although I should drop that since damus is good at retrying writes and spammers are not