Yes, we noticed that some of the spam projects had been grabbing a legitimate user as a second “manager” of the project. Legit projects can do that too, with no notification to the person being added (there is a feature request to add notification and confirmation for such actions).
I’m pretty sure there are no consequences to the legit account when the project gets flagged as spam, only to the account creating the spam project. But still awaiting staff confirmation that this is true…
As for the spam still in the system, it is hidden from view except for curators and the account that created it. I don’t know what the site policy is for when they outright delete such content, as appears to have happened with the spam blizzard from 2 weeks ago.