If you compose an email to multiple @facebook.com addresses, I'm sure Facebook will limit the actual number of recipients in the same way that they do when you send messages through the Facebook message interface, so it's really no different.

With 3rd party spam, the advantage Facebook has here is Zuck's "social graph" -- they can pretty easily tell what the relationship of the sender is in relation to the recipient (and thus how relevant the message is, what the sender's reputation is, etc). It'd be interesting to see how these connections are made when the sender's email address is not associated with a Facebook account, though.