This is not very hard to fix. Automatically downloading and applying public IP reputation blocklists cuts down on this by like 95%. The rest you can catch pretty trivially either with server-side filtering or just filter in the client. I do bad-IP filtering, but not spamassassin/rspamd. The client-side filtering in Mail.app kills nearly 100% of the few spam messages that get through.