We very often see the same username created across many instances, it’s very easy to do and Lemmy has no protections against it. Plus, there are no protections against creating multiple accounts to upvote your own posts (don’t get any ideas 😆). IP blocks wouldn’t work as instances are entirely independent, so there is no sharing of IP info across different instances.
Currently there is at least some level of coordination across instances, though, such as Lemmy.world’s Defense HQ, where instance admins can share info about spammers/trolls so we don’t have to wait for a report from one of our own users. There’s also Fediseer, but this protects against spam instances not spam accounts on mainstream instances.