Please. Captcha by default. Email domain filters. Auto-block federation from servers that don't respect. By default. Urgent.
And yes, to refute some comments, this publication is being upvoted by bots. A single computer was needed, not "thousands of dollars" spent.
Could it be a subdomain, though? What if a spammer started a "Lemmy instance as a service" on "legit.ml", and started creating instances on "lemmy.u.legit.ml"? What if some of the instances were actually legitimate, while thousands of others weren't? What if... oh well, the rabbit hole goes deep on this one.