I have little hope that a spec not designed to reduce/stop harassment up front can have it bolted on later successfully.
But the Social Web Incubator Community Group has made anti-spam/anti-abuse stuff part of our mission, but that's hard stuff. ActivityPub does include federated blocklist support, but I think it's not enough. I've written about possible directions though: https://dustycloud.org/blog/possible-distributed-anti-abuse/
Vouch is a pretty clever scheme — as the sender, you include a link to someone who linked to you, who the receiver also linked to. So your server can detect, essentially, "randos" — unknown sites that might be spam, harassment, or good replies from someone who found your site accidentally.
I haven't yet implemented Vouch in my server software https://github.com/myfreeweb/sweetroll but my idea is to eventually have a settings switch that determines what to do with mentions from randos — reject, require pre-moderation or accept. Depending on your situation you'll be able to change it — e.g. set it to pre-moderation when some spam appears, or set to reject when a harassment campaign attacks you.