Theoretically, couldn't instances have been designed to count the sums of upvotes and downvotes by their users for any given post or comment—those counts being federated with each increase or decrease—so that a tool such as lemvotes would only be able to output a list of instances for voting activity, rather than their individual users?
Doing so would remove the ability for moderators to see individual voting patterns unless that data were also sent separately in an encrypted manner that could only be accessed by moderator accounts, however.