Allowing topic creation through direct delivery email in makes my forum vulnerable to spammers

You can ban SMTP sender domains with at SMTP time with sender_access rules, and do pretty much anything you like with mail via header checks. Given how heavily abused qq.com is, that’ll probably go a long way to solving your immediate problem.

Discourse with incoming e-mail enabled is really very similar to an old-school mailing list platform, with a better web interface, and so the vast majority of the same abuse controls work quite adequately. These include things like not allowing unregistered users to post via e-mail – realistically, there are no mailing lists that allow such behaviour, because it invites exactly the sort of misadventure you’re seeing here.

The one thing that Discourse is lacking in this respect is subscribe (or, in this case, forum sign up) via e-mail – sending an e-mail to <list>-subscribe@example.com gets you a response back with a confirmation code or URL, etc. I doubt that’s going to holding back thousands of potential contributors from being involved in your forum, though…