Will you be doing a full, complete and honest postmortem?
What happened that you hadn't anticipated and had clearly not been prepared for?
What was the vector of attack?
And do you still want to auto-signup every user of the Mastodon app to the instance *you* control?
Still think that's a good idea -- even if it's not directly related to this spam attack?