Do you know if webmentions do anything against spam or if they just defer that problem until the technology gets popular enough for spammers to catch on?
I have not found webmentions-specific antispam processes. I suppose that, a whitelist/greylist/blacklist approach at host level might keep it manageable: if a social host can't moderate its spammers, then it is not worth accepting traffic from.