Indeed they can. Shame there's a vulnerability that allows this kind of spam now, but that's what happens when you keep on upgrading for features instead of stability security and reliability.