Spamming thousands of people can be detected without knowing the content. And if you accept messages from other people than those you are following, you have to accept you will inevitably get some spam. It's like getting PGP encrypted email - you can't expect server spam filter to catch it based on its content and if you report it as a spam, server spam filter doesn't see the content.

There are other solutions to this problem that don't require 3rd party intervention. For example, users could follow each other's block lists.

If Bob spams thousands of accounts he'd quickly get on multiple block lists.

Is Bob a verified, known identity, or does he simply create unlimited accounts and continue the spamming or abuse?

Mastodon is federated, so you already get to choose who your content moderators will be when you pick a server. Blocklists are just an informal and spammy-by-default version of that.