It doesn't take a genius to know that because you can log in repeatedly (there's no CAPTCHA etc) you could just credential stuff Mastodon instances until you get accounts, and then delete them. It will almost certainly happen somewhere.

At the minute the development focus is on new features but I suspect they'll have to be a regroup on basic threats.

I think cred stuffing may be a big issue, you can try to log in 200k times an hour and nothing shows in the admin interface as wrong.