Just a word of caution. Some people are tempted to preserve the link juice coming from such spam backlinks, and that's why they use a 301 to the same URL without the query string.
I don't think that's really a good idea - do you really WANT that kind of link juice, even if it seems to help in the short term? That's why the 404 is a much better choice. However, in a pinch, the canonical link tag on every page can also be a guard against this kind of query string duplicate URL problem.
In fact, I wonder if the canonical link might even help a bit more with Google than a 404 response. (Not tested, and don't want to test it, either.)