I mean, one compromised account leading to a massive influx of spam is a legitimate concern.

You can’t always assume “happy path”.