As for the problem of spammy submissions: charge a small nominal fee of $10 or so to submit, with a full refund if it’s a legit issue (even if it’s a duplicate).
Maybe that's a little farfetched, though.
Not a perfect fix, but I think it helps.
One potential issue: someone on the Mozilla team could pass some of these on to a few friends who then claim some of the money.
It's not a major likelihood, unless the bounties are numerous or especially large.
So long as there is a big of lag before confirmation (which, in practice, there already is), the vendor would know about the issue at least several days in advance of the black-hat even getting a hint and could hopefully patch it in that time.
For especially big holes, just take a bit longer than usual to get back to people until it's fixed.
Another scenario is someone does what you suggest after finding a real vulnerability, to waste the teams time while they exploit the real vulnerability.
The problem is that you can just tell all your friends to file the same bug, and now they have to pay everyone?