the 2nd idea. But in order to validate if I actually own the money it has to traverse through the history. Now, I do not know how fast that is, or how far back it goes. But if it has to check and lets say it takes X amount of time, the spamming it will flood the validation without requiring a fee?

In general the 'attacks' are possible but expensive. However are they government expensive bulletproof? especially if we target less expensive coins aka alt coins.