It’s pretty easy to detect spam. I guess user reports and noticing when someone suddenly messages many new users and those users do not respond.

It's not so easy, because you could even register a new account for each new spam message, or register 100k accounts & only send out 3 messages a day / account..