A captcha (i.e., reCAPTCHA) that must be input for every post.
It's good for all kinds of spam, not just spam from Tor users.
An alternative method could be to simply block Tor users from posting (but allow them to read).
There are 2 kinds of malicious traffic:
Traffic that is the same as 'normal' traffic, but the amount/volume makes it malicious. [D]DoS. (I don't really have an answer for this one.)
Traffic that has been crafted to trigger and exploit bugs in the server software or host OS.
For the 2nd kind, now that the easy semi-fix of blocking IPs doesn't work anymore,...