Isn't the fact that they are using a simple HMAC-SHA256 hash also a root of the problem?
If instead of using the POST data only to create the hash they added another information, like a the hour of the day. Wouldn't it be way harder for a hacker to actually understand what went into signing the request?
That is also the approach that we used. Only the "like" action on our platform is bound to happened ten times or more in a row, so it is the only email delayed.
Coding wise, it is a simple as setting a run_at on our Delayed::Job and a custom queue for this user notification. For every new notification we check if there is another delayed job to be procesed in that queue, if it is the case we just edit the run_at to add a few more minutes.