Switching to opt-in is the right call here to limit any further damage. Meanwhile, it's painfully obvious that the whole thing is aimed to be a "low-touch" / "fully automated" campaign where the participation rules are designed around that goal. Makes sense -- it's easy to scale, etc. However now it's clear that the outcome is the polar opposite of GSoC, where participating in GSoC has prestige and produces high quality oss contributions, and it's facing an unwinnable battle against an internet army looking for the minimum effort end-run around the rules to extract a tshirt...
So, my take is that DO should take a longer view and try to raise the profile of Hacktoberfest by making it more exclusive -- eg take a step toward GSoC. For ex, there are a handful of oss-bounty sites (bountysource, issuehunt, etc) where people post bounties for things they want implemented. Could DO partner here in some fashion? Such as matching bounties in a certain range ($10<x<$50?) with a tshirt? Or matching bounties? Make it a year-round promo instead of one month?