iptables -m u32 --u32 0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x0=0x504f5354 -m recent --set --name lastmeasure --rsource -j DROP
Yes. That's it, and freenode couldn't do it for unspecified reasons. They kept telling us "Oh, we'll be moving to ircd-seven soon, and it'll be fixed then". I bought it. Everyone did. And true, no more spam and netsplits! For now.
But of course, the total failure level didn't improve at all. Now, people who don't auto-identify have a life of pain up their hands.