Yes. Synapse is the server side part of Matrix. You install it at a Matrix host, or on a VPS, or even a Raspberry PI device. See https://github.com/matrix-org/synapse#installing-and-configuration
Once up and running you connect a client like Element to it.
Mastodon and friends are built as open conduits with very little in the way of safety or permissions. Spam should be expected.
It’s not a Fediverse vulnerability. It’s a Mastodon vulnerability. Don’t want spam? Use a better fediverse technology.