Spam is done now. The extra rate limiting helped but a permanent IP ban would be really nice too. It was all coming from a single EC2 instance (with occasional IP rotation). 

 yeah should be easy to stop in that case, until they start seriously rotating ips, but then maybe we could detect spam from ip blocks and block ranges instead.