This first happened with my not-actually-deepfake phishing post, and then again on my posts on not getting hacked and how likely Google lockouts are.

It sounds like there's a business in helping (or scamming) people who've had their Facebook/Instagram accounts hacked?

I've reported 42 of the comments as spam, and deleted dozens more (reporting spam takes several more clicks than deleting, and then you need to delete the comment anyway). Facebook doesn't seem to be getting any better at blocking them.

One of the more frustrating things about this, however, is that Facebook does seem to recognize these as spammy, and so doesn't notify me about them. Which is not what I want: it means my friends still see them on my posts, and I'm reliant on them to let me know about the comments so I can delete.