[sleepychu]

Just to keep you aware, this is a problem you probably need to solve sooner rather than later.

When you're discovered by spammers they will use your service to mask their true domain and share to social media sites which will in due course blacklist your domain. :-(

If volumes are low enough just now I'd consider some kind of manual moderation.

(Maybe you could use the referrer header, detect if the user has come from somewhere else and demand moderation for that case v.s. direct link emailed to a group)

[Etheon]

I agree. I found this package https://github.com/Planeshifter/node-spam-detector

I'll check if it's outdated, and I'll try to build my own system.