Thank you for your concern. Yes, we are aware about the problems of phishing attacks, esp. with gamers and in average many of them are not in the age limit to understand such attacks. Therefore we are working on a system which will require a secondary verification from another device such as a mobile phone. Similar to Google's tap login system where they send you a notification if you or someone is trying to login, and only after you approve the login from the phone, the session will be created. Similar feature of a 2nd step authentication for approving any transactions have been implemented (of course it will not be enforced, but those who wants higher security will be able to secure themselves by activating this feature). Basically to make this happen we are utilizing a multi sig type of algo where if you activate this feature, the primary key will be broken down to two keys of which one will remain with the apps in your primary device and another part in your mobile app wallet. And if by any chance the primary device becomes a victim of a phishing or pharming (DNS Hijacked) attack, the notification on the secondary device (mobile app wallet) will still show you the correct details. So, only after you approve from the secondary device the transaction will go through as without both sets of the key, you won't be able to correctly sign and broadcast a transaction.

As for account spamming I have no idea what you are talking about. All accounts are literally blockchain addresses which will need to have a game access token (similar to a cd key) to each of the games which a user wants to play or own. So, without that asset, you DON'T own any games, there is no point in generating thousand of blockchain addresses and have no coins or assets in them. What you are saying is like generating thousands of bitcoin addresses with no coins in them. This is just an utter unreasonable argument you have put up here.