Wouldn't a spammer almost always be more able and more willing to dedicate resources than an actual user? Let's say it takes a legitimate user 60 seconds of Po

Wouldn't a spammer almost always be more able and more willing to dedicate resources than an actual user? Let's say it takes a legitimate user 60 seconds of PoW on their phone. That's a dealbreaker. Now a spammer that takes them 15 seconds on their server, they will still spam. I guess it could rate limit against high throughput of spam (more like DoS prevention than antispam really), but an IP rate limit would probably work as well if not better. An attacker with a large pool of IPs will probably have a large pool of CPUs anyway.