For some of these operations, you can just work off of the content. Spam messages need to advertise something, so the text needs to look very different than for legit posts.

But something like an upvote or like? It's a single bit of information, you can't say if it's legit or fraudulent in isolation. So then you need to come up with additional signals to cluster on from wherever you can.

Some of it will be behavioural (these 10k users only liked these spammy videos), but a lot of it has to be environmental.