EDIT: I had at least one mistake in the first SQL: I actually excluded the spam of the last hour instead of measuring only that interval. This does not change the interpretation of the result, though, because the spamming went on for a while. I corrected < NOW() - INTERVAL '1 hours' to > NOW() - INTERVAL '1 hours' and apologize for the inconveniencies.
There may be more bugs - this is just a quick hack.
The current spam seems to contain a very limited number of images, so there may be a way to detect the spam by using these images.
Let's see if the blurhashes are connected to the spam, reliably. We expect two results since we currently see two images that are used. The tag is known to contain a lot of spam, but it may contain some ham.
SELECT m.blurhash, count(*) FROM public.tags t
right join statuses_tags st on t.id = st.tag_id
