Update: These are now thoroughly blacklisted. If they figure out how to get past that, I'll blacklist them further. Kudos to Adam Lear for implementing the blacklist.
(detailed answer follows)
Well, we could.
Here's the breakdown of actioned topic requests grouped and sorted by the maximum privilege held by the requester:
Maximum Privilege ActionedDtrs PctTotal
-------------------- ------------ ---------------
null 158 5.154975530179
Newbie 35 1.141924959216
VoteUpMod 165 5.383360522022
PostCommenting 77 2.512234910277
Bounty 103 3.360522022838
CommunityPostEditing 1343 43.817292006525
PostEditing 250 8.156606851549
CloseQuestion 472 15.399673735725
ModerationTools 143 4.665579119086
TrustedUser 319 10.407830342577
By "actioned" I mean "caused a topic to be created" (many more appear to have prompted the creation of drafts that never got approved). Here's the breakdown of all requests that weren't part of this spam wave:
Maximum Privilege ActionedDtrs PctTotal
-------------------- ------------ ---------------
null 712 9.55448201825
Newbie 109 1.462694578636
VoteUpMod 489 6.561996779388
PostCommenting 246 3.30112721417
Bounty 262 3.515834675254
CommunityPostEditing 3325 44.618894256575
PostEditing 530 7.112184648416
CloseQuestion 934 12.533548040794
ModerationTools 322 4.32098765432
TrustedUser 523 7.018250134192
Slightly more on the low-end, but still over 90% of requests would do just fine if there was a 10-rep threshold for that privilege.
Now, just one problem: there's no actual privilege for this. I can't just crank up the threshold to 10 and be done; someone'd have to add logic to check against the privilege.
Meanwhile, these same spammers have been badgering Q&A for over a year; we've dealt with them by putting a blacklist in place to block non-trivial amounts of CJK text. For the past three days, I've been dealing with Docs spam by just periodically destroying anyone posting non-trivial amounts of CJK as a Topic Request; I've missed maybe a dozen requests because I'm only checking the title, but that leaves a false-negative rate of under 1% and a false-positive rate of 0.
So... If we're gonna make a change to restrict this, I'd rather go with the option that blocks zero actionable requests than the option that would've blocked even a handful of actionable requests.
FWIW, we added stricter rate-limiting for folks under 100 rep yesterday (1 request every 10 minutes) - that cut down the volume of spam a lot:
I'd kinda hoped they would just give up after that, but... No. Still creating new accounts, posting spam, getting destroyed.