I don't think this is for de-anon, there's no evidence of that. All the spam is identical between large groups of users, and it's hosted on locations the sender wouldn't be able to see access logs.
If an instance admin would like a copy of lemmy.ca's current spam filter code I'm happy to share, just PM me.
Agreed 100%. Lemmy probably shouldn't auto-load images in DMs, especially if image proxying isn't enabled (still buggy last time I tried it).