welcome to running services on the internet, sadly. Many Mastodon instances either are invite-only (i.e. existing users can invite new users) or use some sort

welcome to running services on the internet, sadly. Many Mastodon instances either are invite-only (i.e. existing users can invite new users) or use some sort of approval-process (write a message to admin, admin approves account) - even quite simple ones can catch non-targeted spam attacks. That helps, especially if its only a sole admin/moderator and not a larger instance with a team.