Well, I have something like HN running on https://handlr.sapico.me ( automatically imports rss feeds)

Wich had a lot of spammers and they worked around the Google Human verification script for logging in.

Humans won't add a Title + Url + text since it shouldn't be used this way.

So ... that flow now returns a xml bomb.

Spam stopped immediately after deploying this. I'm a bit curious how long they spend looking why the memory of their server suddenly went through the roof :p