One of the nice things is that they detect email addresses used to spam signups, so it won't even send an email - which means they can't confirm the account.

But also, emails via mxroute don't end up in spam in my experience.

All that said, doesn't prevent account creation, just emails in spam and account confirmation.

If that's not useeful, my apologies and do ignore me

Eventually the email provider protects itself by rate limiting the incoming emails so they aren't even seen. This causes the SMTP servers to continue trying to send the emails due to the temporary failure, generating even more email.

Ultimately the email provider will shut down the email address, and that poor person cannot see any of the emails sent by the bank with warnings or account instructions, and it certainly delays recovery until all the assets are removed from the account.

You should close registrations or at least require approval.

I don't know how it works on Peertube, but on Mastodon, the email validation is sent even if approvals are required, so it doesn't stop the bombing.

You can check your logs for some way to recognize the incoming requests and set up a firewall rule if you have access to a firewall that can do this.

Can you enable a captcha for registration application?