good thinking 
npub creation or first post timestamp can used as FILTER KEY
no legit manual npub or test npub can still be allowed
any npub age of few secs  or hours can be blocked / dynamic cache block-listed for spamming
if they bypass using mass old npubs? then throttle can take care from there