Spam (like the torrent of cryptoscamspam lots of people got this morning) has been very rare for me here (and dealt with quickly), but I've noticed that almost all of the spam I've gotten has been via Mastodon's DM feature.
I really wish there was a way to turn DMs off or at least restrict them to people I follow. Control over incoming DMs was a thing Twitter did better than here.
DM behavior is a big deal, because people, for better or worse, often use DMs for both private things (that should stay confidential) and important things (that they expect to be seen by the recipient). The way Mastodon mishandles and obfuscates the semantics of both is a big source of potential harm to users.
A broad reasons Mastodon DMs are such a mess, I think, is that mixing a private messaging function with a broadcast medium tends to end badly. My students and I explored this mismatch a bit a while back.
Mastodon, like email and encrypted two-way radio, is based (approximately) on a "throw the message out there and hope for the best" delivery model. But the reliable protocols we use for secure and one-on-one communication are based on multi-round-trip handshakes and negotiation before and during message exchanges. Shoehorning DMs into the same mechanism to broadcast out toots is an inherent impedance mismatch.
@joshka @mattblaze if you were going to do that, Matrix is probably the best option (certainly not Whatsapp--fuck Facebook.)