A lot of this stems from instances running old versions with loose registration requirements, like no captcha. This is a problem in a federated system because there’s no barrier for a banned user to just jump to another instance.
Perhaps it would be a good idea if, when Lemmy has anti-spam measures implemented like rate-limiting and captchas for registration, it disabled federation with instances that are at a lower version, to motivate small instances to upgrade and enable the new features.