I like this approach. You are correct: you need to address the root cause of the issue, rather than an overly generic blank rule.Wedge let you build custom rules for this, e.g. 'if post is by people in (groups), contains more than x links, moderate the post' (where you could do more than that, e.g. you could refuse the post, or change number of links and various other rule components). It was in part inspired by the 'Anti Spam Links' mod that simplemachines.org uses.
On Invisioneer.org, I recently activated a new IPS cloud spam analysis. Unbeknownst to me, it ended up holding every first user's post in moderation.