I think it depends on the reason of why you release your code as an open source project in the first place. If your goal is simply to let your code available to

I think it depends on the reason of why you release your code as an open source project in the first place. If your goal is simply to let your code available to general public, reviewing unsolicited contributions will feels like a huge drain of your time and probably not worth it as it may not align with your goal. Just let them fork your project and continue as usual. But if the goal is to build a community around your open source project, then I think it's still a good idea to engage with those unsolicited contributions even though it's a major time sink.