good thinking
npub creation or first post timestamp can used as FILTER KEY
no legit manual npub or test npub can still be allowed
any npub age of few secs or hours can be blocked / dynamic cache block-listed for spamming
if they bypass using mass old npubs? then throttle can take care from there