You can't do this just watching network traffic because the apps use HTTPS + certificate pinning.
And you can do it if you want. I do it. I'm sure many more people do it.
And you can do it if you want. I do it. I'm sure many more people do it.
By spamming I don't mean the usual "click on this link and I'll show you my tits" spam; if you create a useful bot that sends "expected" mentions (for example in response to mentions you receive, and not just spam) it will get banned in a matter of hours. With their "secret" tokens, it won't get banned.