Thanks, Matt! Much appreciated. I owe you at least a for this super helpful howto. I have now implemented the above and added the offending domains to it - I’ve let it go for an hour and so far it’s been quiet.
One clarification: In setup above, you use the /var/docker.. path when I think you mean /var/discourse.. - though I suspect different instances may use different paths depending on when they were set up. These days I suspect most people use /var/discourse.. which is also reflected in the other howto you link to for setting up direct delivery.