Think about an actual bot farm trying to infiltrate a website. They’re creating dozens of new accounts a minute using random strings of characters as usernames, and eventually to reduce the load on their admins the website implements algorithmic username screening: if it doesn’t follow at least some rules of a known language, the username is kicked out and the account banned.
So now the owner of the bot farm realizes that essentially none of their bot usernames are getting through, but maybe this is an opportunity! They could use the bots to try to overwhelm the admins with reports/appeals; lock them up with handling those, and maybe they can sneak some human-generated usernames past the goalie and wreak some havoc while the admins are working through the garbage in the appeal backlog.
At this point, the admins could either turn off new users for a while, until the bot farm owner gets bored and tries somewhere else (unfortunately this would probably mean a bunch of real human users also getting bored and trying Bluesky or Threads). Or they could use the information the bot farm is helpfully providing against the bot farm: snag the IP addresses from every nonsense username that’s trying to sign up, and add it to a global report/appeal ban list. Extra bonus: if you run two instances, sync your global ban list so that a bot that tries at one of them doesn’t also waste time at the other.
Unfortunately, I think op just got false-positived.
To be sure, all of this is fan fiction at best. I don’t know for sure if any of this is how Mastodon is running things. It’s all just educated conjecture at this point.