I’m talking about a genre of emails where the targets are those who’ve simply starred a GitHub repo. Even if they get the actual email addresses from a git log

I’m talking about a genre of emails where the targets are those who’ve simply starred a GitHub repo. Even if they get the actual email addresses from a git log or off-platform, they’re still abusing the GitHub API (or screen-scraping) to discover users to spam in the first place. It is possible for GitHub to guard those list pages with captchas and use reports to catch API abusers.