It is peer-to-peer. If someone keeps spamming you from the same IP address, then you can block that address. If you're getting spammed from multiple IP addresses, then you're essentially getting DDOS'd and there's nothing you can do aside from blocking unknown senders.

You could use a system like hashcash to approve new unknown contacts if that starts being a real issue.

how is that handled in other p2p apps like Briar, Status or Session?