Spam (like the torrent of cryptoscamspam lots of people got this morning) has been very rare for me here (and dealt with quickly), but I've noticed that almost all of the spam I've gotten has been via Mastodon's DM feature.
I really wish there was a way to turn DMs off or at least restrict them to people I follow. Control over incoming DMs was a thing Twitter did better than here.
DM behavior is a big deal, because people, for better or worse, often use DMs for both private things (that should stay confidential) and important things (that they expect to be seen by the recipient). The way Mastodon mishandles and obfuscates the semantics of both is a big source of potential harm to users.
A broad reasons Mastodon DMs are such a mess, I think, is that mixing a private messaging function with a broadcast medium tends to end badly. My students and I explored this mismatch a bit a while back.
@mattblaze I love mastodon. But it definitely needs an "actual" DM system (preferably end-to-end encrypted, obviously!)