Turns out that the HN flagging mechanism hides the message from their auth check, so the spam doesn't actually work anyway. Oh well.