Yes it's a game of cat and mouse, but starting out with a defeatist attitude, the cat makes things way too easy and the mice will simply roam free. Making life hard for the spammers can and will get rid of all but the most persistent.

The other issue I have with this particular GitHub spam is the notifications persist even after the spam has been removed. You get notified and subscribed to some random thread because you were previously tagged in it.

After GH removes the spam (which is currently too slow) they should also retract any notifications or subscriptions that were made as a result of the spam comment.