I don't think pubkeys are above your pay grade. This is actually quite simple. Most Bitcoin address are a result of hash function (except prefixes etc.). The output of any hash function is deterministic, but also looks random (it's not random, but you can't tell what and if it contains any information). So , because this random look of the address, we can't tell if the address is modified or not to contain spam. Even if an address looks like it's modified, you also can't exclude possibility it's valid. That's why it's so difficult (actually impossible) to filter them out. The spammers have to include additional data markers to recognize their own spam. Once we know what markers they use, we can set a filter. But, at that point they can just change the markers and we start from scratch updating the filters. Cat and mice game ;) Hope it makes sense. Unfortunately it's only one of many pieces in this whole debate about spam :(