Yes, and they would be using up names that others might want. If there's a cost per account and/or it has to be tied to an account on another service then this should be harder to do. I expect other services have had to deal with mass account creation. I've seen accounts of companies creating lots of fake FB accounts using hundreds of mobile phones. There's no foolproof system, but Steemit can exploit what others have already done.