I do notice that when I post a new repo there are immediately a number of clones and I've been told they are bots looking for keys accidentally left in the code.
I’ve experienced this about 2-3 times. When I got tagged in a spam issue, it bypassed email spam filters because the emails came from the GitHub domain. It wasn’t a good experience.