It might only need to be the first N reports from a given account. It's hard to imagine a spammer coming up with 5 legit security issues just to enable their GPT spamming operation. As long as they're not real-but-trivial typo types of issues...