regarding the mastodon.social #spam I just tried and confirmed there is not even anything like a captcha during the sign-up process. I made an account with a throwaway mail provider within seconds.
Why does Mastodon not group DMs from people you don't follow in a specific view? Twitter has this as "Message Requests" (which by the way for me are filled with the same kind of mention spam as that currently originates from M.S., because spam logically follows from open sign ups)