If you implement webmention spec then the URL and page that mention you have to have a link on the page back to the post they are mentioning. This filters out a lot of spam. There's a more complicated anti-spam system that isn't fully implemented yet.

I personally run a catch-all for POSTs on my webmention endpoint so I can do pingback and arbitrary stuff with it too. In terms of spam, yeah, old trackback/pingback spammers are still doing their thing. I get a dozen or so a day. It's easy to filter most out by looking for any triplicate or greater POSTs but that requires doing batch processing.

Overall I think webmention would fall to spam if it became popular but right now it's a wonderful time. This applies to all systems open enough to be useful. It's the natural lifecycle.

Some talk of Spam and 'OcapPub' by Serge at https://archive.org/details/apconf-talks