Part of the problem is the instance’s open registrations which do not require you to enter an e-mail address during signup.

How is this even a thing? Why would the Lemmy software even allow operation like this?

That would be my first reaction, as well. When a giant reptile lunges at me, I would totally grab it and start wrasslin’ with it.