Subsequent to opening this topic a couple of years ago, we engaged in a test using a honeypot email address that is published on our web site. Humans would know not to use it. In all this time we have had just a small number of spam emails.
I recently stumbled across the Rejected tab of the Discourse admin page called Email Logs. While there, I found numerous examples of Discourse rejecting spam email. An easy way for other admins to find their own examples is to type “autogenerated” into the Error filter box that appears on that page, or you could use this link when logged in as admin…
https://yourdiscourse.com/admin/email-logs/rejected?to=contact&error=autogenerated
In every case, the emailer attempting to send spam to us had an auto-reply address and this is one of the criteria that triggers rejection.