Thanks for details

@magical_cat I run a relay (publicly known, but not on the official list) and nobody (spammers) ever bothers it, just the usual SSH brute force login attempts (I use fail2ban on the ssh port of the relay).

The process to create an account requires "doing work" (setting up the keys, etc.) and not just the traditional "make login, send spam". There are technical hurdles which sort of stop spammers from even trying. (so far, yet, etc.)