Since project maintainers don't have to opt in to Hacktoberfest, there's no reason for them to know that the FAQ exists. Most maintainers are unaware of what's going on and will just close the spammy PRs without tagging them.

Oh yes, I wasn't disagreeing about that. I said as much in an older thread about another group of people attempting this same thing: https://news.ycombinator.com/item?id=23968008

The code in the linked repo with the stats is literally:

>const totalInvalidLabelPRs = await db.collection('pull_requests').find({'labels.name': 'invalid'}).count();

They also mention the label "invalid" multiple times and never the label "spam." So even if they count "spam" for making entries invalid for a reward their stats do not seem to take that into account.

I believe this is a change between 2019 and 2020.

Ah. Nonetheless given this is analysis over historical data I would label any PR that hasn't been merged in over the last year as effectively spam. The fact that none of their stats seem to include how many PRs were actually merged in is rather concerning.

It would seem like a much better idea to say that only PRs that are explicitly confirmed by the project maintainers as being valid will be counted.

Then you'll get people spamming maintainers to please hurry up and review/confirm their important PRs, and abuse if they don't.

That's easier to deal with, because the maintainers can just reject the PRs and not have to worry that the spammer will get goodies from Digital Ocean if they don't mark it as "invalid" or "spam" or some other magic tag. And as a maintainer, high on my list of "reasons to reject" would be "bugging me about a PR from a random person I've never had a submission from before and who has no other track record of contributions to open source projects".