It is hardcoded. The string 'enoughmuskspam' is right here https://codeberg.org/rimu/pyfedi/src/commit/b7a9ea0eea3a80f710e0b5b63cf0bbecde60f8bf/app/admin/routes.py#L373
I have noted in other threads and will note again here because people keep attacking me about this: hardcoding does not mean the behavior is not circumventable. It just means the string is in the source file (rather than a config file or database).