Were you some how reading our Slack coversation where I said the same thing 
No, in all seriousness, I believe that to be 100% correct. SSO is bypassing the spam counter-measures that Discourse has by default by being a JavaScript heavy application.
In the meantime for those who also use SSO and have seen this problem, we’ve pre-emptively blacklisted several email domains to help combat the issue, as it seems the blacklist setting is still in effect even with SSO (based on coversations we’ve had with the SP devs – I personally haven’t had time to dig into). It is still a bit too early to tell if the blacklisting is working, but we’re crossing our fingers. But I don’t see any reason for it not to work at this point in time.