A per-user rate limit of some sort could have reduced the attack surface I think? Something like that would be quite a bit of dev work to implement though…
At least the situation was promptly resolved and users nuked, although R.I.P. to any smaller Lemmy servers that went down due to the massive spam wave