There was a third form of moderation that was less-visible, because it likewise was primarily an anti-spam mechanism: Server-side filtering of incoming cross-server traffic. IIRC, most servers had extensive blocklists and filters, often based on the metadata of which other servers the message had passed through but also including things like "does the message contain binary data posted to a non-binaries group?"

My guess is that this filtering was also largely responsible for implementing the "moderated group" form of moderation, in that unsigned messages to moderated groups would also be filtered out. (Ideally, they would be rejected by the server where one tried to post them, but relying on that requires trusting everyone else's servers, which generally wasn't the way things were done.)