Earlier quoted context omitted.
That's a good point. But this sounds a lot like user blocking tools? At one time, making sure that users could block other users on the same social network might have seemed like it might enough to prevent abuse and keep social networks out of the moderation business. Users that don't get along can just block each other. Good enough? Maybe not. You say you know the "worst case" but that might not be imaginative enoug…
Phishing combined with botnet attacks across multiple instances could probably pose a big problem for the network, but here's where the second facet comes in to play: instance operators are not incentivized to grow their userbase at all costs. Performing actions that might please their core userbase but may make it harder for new users to sign up, or other hurdles are something that instance operators won't shy away…
Though there are email blacklists for known spammers, and it can be hard to administer a new email server. You wouldn't want to block Gmail, though.
Speaking of which, I'm not seeing why every instance operator would decide not to grow. It seems like, if the federated protocol is successful and allows it, new large providers would spring up like Gmail and Hotmail.