[CarelessExpert]

At minimum Webmention requires the originating site to be hosting content that actually references the mentioned page.

Spammers would then have to host the location where the spam is located, and then you can block them.

But, frankly, this isn't actually a solved problem yet. I'd imagine building a spam blocking engine on top of a service like webmention.io is an obvious next step if/when this becomes an issue.