To be honest, I was worried about that as well. But it's been pretty good so far.
Gitmask always adds a comment in the PR mentioning where the PR is comming from, so in the event of any projects/repos getting spammed, I can hopefully disable PR's being opened against those projects.