[mikebos]

It may seem obvious, but add an registration through oauth providers like google and facebook. It should trim down the amount without a lot of impact I guess.

If all that abuse is in Russian you might just try to deny service if Russian language is used or add an extra hurdle like browser fingerprinting and rejecting the combo language + fingerprint within a timeframe.

Depending on your user demographic you could also use a reputation system for ip's. Trusted no delays, untrusted delayed for 10 minutes and if something similar is found within that timeframe (use regex) drop the message.

[dyeje]

This. Require auth, it also allows you to add stuff like rate limiting per account to further prevent abuse.