I've created a patch which seems to resolve the issue for me - I've seen 0 spam submissions over the last 24 hours, down from 2/minute before applying it. This patch changes how the antibot_key is processed and passed to the client, so bots can't get to it without multiple processing steps.
I'm encountering an issue after applying patch #50 to Linkit 6.0.0-rc1 (as well as Linkit 5.0-beta 13), the data-entity-substitution, data-entity-type, data-entity-uuid attributes are no longer being added to the link, so the LinkitFilter is no longer working. I can't see why this would be the case after applying this patch, removing the patch resolves this and the attributes are added but I need the functionality provided by this patch. Could anyone suggest why this may be the case?