All these small instances that haven't enabled captchas, manual approval or invitations, thus becoming victims to the spambot...
Verifying an email address doesn't really prove anything these days. Too easy to make one. The spambot is taking advantage of that fact, plus the fact that instances don't have to pass any tests to access the network, even if users do.
We can't teach every new instance owner to enable extra checks. We also can't assume that every new ActivityPub server that appears can be trusted.
It would be easy enough to filter problematic content if you ran everything through something like Bogofilter (simple but effective spam classifier) on the way in or out. Could also be used to alert admins to problematic accounts and posts. You can train such classifiers to look for other things than spam, such as slurs and hostile language.
Not something your average #mastoadmin could implement. Such filtering should be implemented by the Mastodon team. But they're allergic to "algorithms" there, so I doubt that's going to happen.
