The list default for new subscribers is to hold posts for approval before sending to the mailing list. Hopefully that will cut down the number of spam messages, at the cost of delay of maybe a day for new subscriber posts. In order to make the policy clear, I submitted a PR to numpy.org . Comments and suggestions welcome there.
Update: we now have a team of moderators for the mailing list. The policy for moderation is in the list summary .
Since moderation began on Oct 26, we have rejected 15 spam messages, unsubscribed 2 email addresses that spammed more than 3 each, and released 4 messages from moderated users to the mailing list.
Upate: since there is a clear delineation of spammers vs legitimate posts, I would like to tweak the policy  and from now on a single spam message will move email addresses down a category: from authorized to moderated and from moderated to unsubscribed. I have changed the policy statement accordingly, pending disagreement here. It makes the bookkeeping simpler since we don't have to track spam messages (we get on average 1 or 2 a day)