Spamming account creation won't work, because accounts need to have been created in April or earlier. They also verify address, payment method etc. to reduce double-dipping.
I guarantee you there are lots of sleeper accounts out there that have made "a purchase", which could be less than a dollar. It definitely helps to require any purchase at all, but if they were trying to be semi-thorough that requirement would look more like $100 in purchases.
There's probably more to it than that, and Valve just isn't telling us all the details.
It's likely they are weighting accounts that have a lot of (recent) game activity and game purchases as well. Plus, they have access to hardware information via their hardware survey, etc.