BuddyPress.org

And this would specifically deal with spam from actual users who have managed to sign up and and now using the internal messaging system to spam, correct?

And not spam signups, spam blog. Just to clarify.