Mastodon is very, very vulnerable to spam - a lot like email before SPIF/DKIM/spam filters. I hope the community is able to fix this before the spammers figure out how to exploit it.
@dfeldman also - pretty easy to DoS current ActivityPub implementations even without trying to. The "killer" feature (everyone can have their own server) is also the **killer** feature https://mastodon.ar.al/@aral/109315412776960105