Spam is done now. The extra rate limiting helped but a permanent IP ban would be really nice too. It was all coming from a single EC2 instance (with occasional IP rotation).