If you had read Hacktoberfest's previous blog post on this matter. They even encouraged those spammers to create a repo on their own github account and create 4 PRs within those repos just to get qualified for the T-shirts but I think anyways the damage has been done and by providing T-shirts to those spammers they're not penalizing their behavior any ways.