I think some of these are noobs building this for themselves but forgetting to close the door. Spammers most likely will get their own instances but you can defederate the entire server easily. It gets harder when spammers mix bots with real users on one or multiple instances.