I’m puzzled by the spam problems you have had @jamie, this site has about one spam post every two months, 13 spam posts in two years.
I’m sure you have some horror stories of MediaWiki or phpBB sites being utterly destroyed by spam bots in the past, I sure do…
Discourse really doesn’t appear to have this problem, however I was expecting it to be really bad, based on past experience… so we have configured the Discourse servers we host to sit behind an anti-spam gateway server:
dig mx community.coops.tech +short
10 mx.webarch.net.
Perhaps this is taking a load off Discourse, that server is running SpamAssassin.
For outgoing and incoming email we are doing this on the VM hosting Discourse itself, see these (old and in need of serious update) Ansible tasks:
And this works fine once configured.
For small activist or community non-profit groups I don’t think Discourse is a practical option, this is why I spent a while writing a Flarum Ansible role, I just need an organisation to test it with now 
.