I don’t think that’s a perfect system anyway though, spammers could create a massive tree of fake accounts and just only use a small proportion of them for spam

Use a number of compromised user accounts to set this up and it becomes a nightmare