eventually write a script that starts up new instances and then runs spambots on them.

Spammers wouldn’t even have to run Lemmy to spam, as they could have a spamming script that uses ActivityPub directly. I really hope that doesn’t become widespread…