proof of work is a good measure against DoS attacks, but not against low to medium volume spam.<p>SHA256 in particular has hyper efficient GPU/ASIC implementations. set the difficulty high enough to hang the browser on an average phone or a laptop for several minutes, but a dedicated spammer can just rent the hardware to solve those in fractions of a second very cheaply