Email-in topics/posts go through a very similar path as regular post creation, so AI spam would most likely cover you.
Just confirming, did you go through the “reserved usernames” site setting?
The setting description shows “Usernames for which signup is not allowed. Wildcard symbol * can be used to match any character zero or more times.”, but without getting too pedantic with the definition of “signup”, this feels like a bug.