Lemmy is federated, meaning independently hosted instances interact with one another. Instances often also have significant measures in place to prevent the automated creation of multiple accounts. However, anyone can host an instance. Wouldn't it be possible for someone to host their own instance without any spam prevention measures, automatically create multiple of their own accounts, and use those accounts to flood a post with upvotes/downvotes? I'm aware that instances can block interaction from other instances, but if done correctly it would be easy to do it without raising much suspicion. Does Lemmy have any safeguards against this, and if not, is it even possible to fix?

Note: I don't plan on doing any of this, I'm simply just curious about how it works.