People don't set up email servers on VPN endpoints. That's not how email works.

You don't need a mail server to send mail. One can send mails through a VPN as client.

Then the spam is coming from the email servers which are used to relay that spam. Headers can be forged, so the source before the spam server can't be trusted as real.

spammhaus is blocking self-hosted smtp servers.

Have a look at grey listing.

With Sonic I have to use their servers for outbound stuff since they block outbound SMTP without a static IP (and they don't offer static IPs with fiber). It's a price I'm willing to pay since I typically don't see false positives (and ye I check my logs periodically) with Spamhaus.

Unfortunately I've moved to Proton and the increase in spam is pretty damn frustrating.

Spamhaus is blocking by IP which can be an smtp server or a client. The SMTP protocol does not allow to distinguish a sending SMTP server from a client.

By using a VPN, you "randomize" the IP address and thus make spamhaus and equivalent services useless. I created my own IP blacklist and tracked it.

The only method I found to filter my spammers is to reject mails from hosts without a name. This eliminated 80% of spam, but it won't last long.

The mail system is completely broken.

use grey listing

I have spammers retrying 20 times before giving up. This protection is well known and easily circumvented be spammers.

but it filters a lot already because many do retry 20 times in less than 20 minutes.