It's possible, but it if it looks like an issue, we will change things so as to know who is so dastardly, and who they have promoted.
Another possibility is to rate-limit it. Say, you can only promote once per day.
Jw, what're the current password requirements?
Very very low.