Won't any address used even once still be visible in the public blockchain and thus be a potential target for these spam transactions that never confirm?

I don't see how it is an issue.