There are a few things in place to protect against spam.
For one, every account is limited to 50 questions in 30 days, so if this is a legitimate user posting a lot of questions, they will get rate-limited fairly quickly.
If it's a bot, that's less likely to be an issue since the offenders can just automatically create more accounts. In this case, flag one of the posts for moderator attention and mention that the account looks suspicious and is a possible bot/spammer. Moderators can investigate from there and escalate to the Stack Exchange team if necessary.
Don't worry about overwhelming moderators. Prolific spam bots are actually relatively rare (so far), but even if we do run across one, it's easy to investigate their posts at that time and take appropriate action.
I mean I can flag to my hearts content but at some point a more drastic action may need to be taken and if so whose decision and how it is decided and what's the regular user's role in all this?
There is also a way for regular users to remove spam and offensive posts by flagging them as spam or offensive without getting moderators involved. Six spam/offensive flags on any post will delete it.
Beyond that, the regular user's role is to notify moderators. :) That's what makes Stack Exchange able to handle spammers and various other bad things with a fair amount of efficiency. Moderators can't be everywhere, but regular users can report strange or abusive behaviour.
Usually what happens is that moderators will take action against an offending account (by either destroying it or placing it in suspension, depending on the case) and that's the end of the matter. Persistent cases can be escalated to the Stack Exchange employees and we investigate further to determine if an IP ban is needed/feasible, or whether we can do anything else.
So, in short, these cases are investigated individually. Regular users and moderators are the first line of defense, followed by Stack Exchange employees who can set up an IP ban if necessary.