Disallowing automated publishing would prevent CI/CD scenarios.

The spammers are creating large amounts of one-off accounts on external login providers like Microsoft Account. I’m sure those have some sort of CAPTCHA.