True, but then a spammer need only implement PoW in their malware framework. Most spam today comes from malware infected PC's and rented VM's. CPU and network resources are free. The biggest challenge for the spammer will be getting updated malware deployed to support PoW, assuming their existing malware can't update itself via a command and control server. Unless you are selling crypto keys that are used in this PoW that can be revoked when abused, the malware need only know how to solve the puzzle.