I assume that by "spam", you mean a DOS attack.

#2 won't work well for several reasons.
#3 won't help if there is no way to distinguish between real transactions and spam. Otherwise, it would only make the problem worse.

DOS attacks only work if the cost of the attack is less than the benefit, so the obvious way to prevent them is to make transactions costly. But there could be other ways, such as being able to identify the source of a transaction.

DOS attacks also only work if they are big enough to disrupt the network. If a network is big enough or has enough capacity such that it can't be disrupted, then there is no issue. Consider the futility of a DOS attack against the entire internet.