Hey domenic - I work for DigitalOcean on the Community team.
We also noticed an uptick in spammy PR's and we are working on a bunch of immediate and long term changes to improve the situation for Open Source maintainers like you.
We could change it to be opt-in only, but the participants who are creating spammy PR's have already shown they don't read rules, so I think they would continue to create the same PR's.
That's why, to deal with the immediate issue we're creating an obvious, even lower-effort route for the impatient participants to take (follow a guide to create 4 PR's on your own repo) - and longer term we'll make bigger changes (maybe including an opt-in only model) that solve the perverse incentive issues that seem to be driving this PR spam.
We have a system to invalidate spammy PR's, but not spammy users.
The problem with most "spam flagging" solutions is:
1. They only kick in _after_ the PR is created and the maintainer's time is wasted.
2. In some cases they might actually cause more harm than good. A user is flagged for spamming, gets blocked, creates another account and spams some more... etc.
For that reason we are focusing our efforts on just re-routing these impatient users into guides that have them creating PR's on their own repos.
Long term we are definitely committed to updating the program to make sure it's delivering on the mission of getting people positively involved in open source.
We also noticed an uptick in spammy PR's and we are working on a bunch of immediate and long term changes to improve the situation for Open Source maintainers like you.
Here's an official post where we walk through currently proposed changes: https://hacktoberfest.digitalocean.com/hacktoberfest-update