i guess it's a case of each instance admin whacking these moles as they pop up. also having anti bot signup defenses.
I'm guessing there's also stuff that could be done server side to stop single accounts sending the same message to > 100 people or something like that. not sure if that's already implemented though.
There is a cost associated with setting up each new instance, domains cost money. Time and effort would have to be invested in automating the set up and teardown of such instances on a daily basis (if the scammer has the ability to do that otherwise they'd be doing it manually). Spammers don't tend to like to spend any money
federation, from what i understand, requires active users to fully integrate with other instances so lots of PMs coming from federated instances with little to no active users would be detectable i would imagine.
There are technical solutions to these problems. as with any platform, it is always an arms race between spammers and the developers/moderation teams.
Mod tools are useful in automating this sort of stuff but some things are better handled at the low level by Lemmy developers.
I looked into creating some mod tools to help with this sort of thing a year or so ago, but i'm a backend guy if i'm anything dev wise. CSS did what CSS does and gave me a big enough headache to quit