When lemmy first started getting popular when reddit initially started cracking down on 3rd party apps, I made a shitpost community and then made a really generic post, then promptly got banned for "trolling". Not bad.
That's potentially a viable attack route: register a billion dead accounts to fill up the database. Reaping them if they never complete an activation step like confirming a ToS or email verification would help protect the server.