Thanks very much for clearing out the spam.
What you’re seeing as “attack surface”, we see as “content”. Most spammers won’t care if there’s a post that meets any specific criteria to bump: They’ll just pick some thread at random to post in, and if the thread they randomly pick is closed, they’ll just pick a different one. The only way to stop spammers by reducing the “attack surface” would be to reduce to to zero.
But legitimate posters do sometimes post here, specifically because this is the one place on the Internet that’s talking about some obscure local celebrity, or a half-remembered dream, or some other random but very specific thing. That’s not attack surface; that’s growth surface.
Not really; in computer security there’s lots of layers, e.g. “belt and suspenders” or the “swiss cheese” model that was recently mentioned w/r/t the pandemic. The idea is to make it a bit more difficult at each layer, but not so difficult that everyone gives up, e.g. “ah, whatever, the rules are too complicated, I’ll just attend this giant party” 
OK! Phew, that was a lot of work… this is complete, to the best of my searching ability – thanks to @running_coach and @Dewey_Finn for tagging so many spammers over the years. 