Lemmy

They can do this, and it is cat and mouse. But...

1. It generally costs money to stand up an instance. It often requires a credit-card, which reduces anonymity. This will dissuade many folks.
2. A malicious instance can be defederated, so it might not be all that useful.
3. People can contact the security team at the host providing infra/internet to the spammer. Reputable hosts will kill the account of a spammer, which again is harder to duplicate if the host requires payment and identity info.
4. Malicious hosts that fail to address repeated abuse reports can be ip-blocked.
5. Eventually Lemmy features can be built to protect against this kind of thing by delaying federation, requiring admin approval, or shadow -banning them during a trial period.

Email has shown us that there's a playbook that kind of works here, but it's not easy or pleasant.