I'd wager that people would cry far less about a few small security measures than they currently do about the absurd spambots. In fact, a number of other sites I frequent have some of those measure in place and I have yet to hear any complaining about them.
I can't speak for alexkitch, but I do do development. I do it every day. And yes, most of these simple security measures are pretty easy to implement.
DDoS != spam. DDoS attacks exploit a physical vulnerability of the technology (i.e. the servers hardware can't physically handle huge numbers of requests simultaneously) while spambots exploit a software vulnerability (i.e. this site's code makes little or no attempt to detect or hinder spammers).
I doubt tom's would let me at their servers, but there are plenty of tools readily available already .
My guess is that spam blocking isn't really that big a priority for the devs, which is unfortunate.