how far a spam can go?

Can a spam bot do that? Yes. I could write a script that could do that. In fact there at least a couple of different ways to do it. I’m sure the spam folks could too. The trick is that to register you need an active email, and I think this would quickly foil most real world attempts at this, which is the point of the two-step registration.