Ahh, I get like 2 spammers a year and we catch them after a few posts. Didn't realize it was limited.
If you weren't around to catch 100,000 spam posts, I doubt any real members were either. Might be best to flush and restart or backup from before this happened?
Only if an admin is daft enough to set the Bypass flood check to Allow. With it set to Not Set (No) and the standard 30 seconds set in the ACP, it would take around 10 hours to make 1000 posts. No spammer is going to sit there for that length of time to do this.
I would consider having all new lowest level members posts go into moderation. Ours do and we have never therefore had a Spam message on display. That makes posting them rather pointless and wastes the time of the spammers instead of yours, which is neat. We only move them out of that level when we feel certain they are good guys. We aim to get a posted message on display very quickly and all subscriber messages display straight away and so on.
Have a team of moderators, who moderate new messages and delete the bad ones, along with the member if you wish.
As Mike said, you can batch update threads in the Applications tab of the Admin CP and choose to batch update threads created by a specific user.
For managing it in the future, aside from enabling flood control (which should always, always be turned on - the completely minor inconvenience that a user will have by waiting 10 seconds to make a post is invisible compared with the major problem that a spammer with no flood control can cause), I've installed FoolBotHoneyPot, StopHumanSpam, and pay $5/month for an Akismet subscription. This has basically eliminated all spam in our forum.
We're blocking 80-150 bots per day from registering, the couple that get through and try to make posts have their posts placed in a Moderated queue, and the StopHumanSpam plugin prevents bots that register from quietly adding links to their profiles or signatures.
It's pretty outstanding. I went from managing 20-30 user-visible spam posts per day, another 10-50 spam user profile posts per day, and an unknown quantity of bots with spam signatures (which I was manually purging at monthly intervals), to 2-3 spam posts per day that are all caught and put into the moderated queue.