@Codeberg Props on taking a stand on this.
One thing I'd like to suggest is that any functionality that can be used for unsolicited contact with other users, especially mass contact (e.g. @'ing accounts in comments) should be heavily rate-controlled, limited to a small number per day (or per unit of moderation latency) and possibly even held for moderation entirely for new accounts without good repuration/standing except when @'ing someone who's already working on one of their own repos.