Great question! It's managed on chain through rate-limited transactions. There's also cost to account creation and additional costs for someone who wishes to have more stake to make more posts. The more stake they have, the less interested they may be in spamming the network.

Application layer solutions may also appear .. where members may find consensus on spammy accounts and default hide their posts.

Additional info can be found here: https://steem.io/SteemWhitePaper.pdf