I have to assume the messages are stored in a SQL database or at least something that supports queries. I assume the site is hosted on a server that can run tasks. When I administered public facing servers I would routinely run DB queries to get a feel for what was happening and it often revealed things we didn't know were occurring so I know a) it can be done and b) it is effective. There is no need for AI or word or phrase searches these aren't what are plainly getting through. Check the latest and you will see accounts created "today" are sending multiple messages in under a minute. Nobody needs to see if if some drug name is in the title only that an account that was just created has posted 5 or 10 messages a minute. If this isn't captured on the front-end (and obviously it isn't) then any simple script that runs periodically checking for these conditions since the last run will reveal what are almost guaranteed to be inappropriate spam messages. Mark them for review (hiding them) or simply delete them and the account. This is DB administration 101 isn't it?