I haven't had spam problems since the big spam era back a few months ago. Clients have at least these options:

1) banning pubkeys -- if a pubkey becomes a spammer, ban it

2) rejecting new pubkeys -- reject events from pubkeys you have never seen before

3) require a social connection -- block replies from people with no connections in your social graph

4) make the relays do the work -- block replies from relays that aren't known to be good spam filterers

5) block by content -- use some email-like bayesian spam filtering that bases it's decision on the content

6) require pow -- on the message, or on the pubkey

Relays can also use IP address reputation, requiring payment, or just human eyes and decision making.