Question about spam attacks
yes, but then the "spammer" hasn't really accomplished anything.

essentially with spamming its either
1) you paid to get a "spam" transaction included in a block
or
2) you paid nothing to get it in the mempool

not really spam either way at this point