I started looking into this a couple of weeks ago and came away with the impression that there's a huge difference between what a phone or a laptop can mine and what a GPU farm can mine.
If that's right, then with the current mechanism you can prevent casual spammers but cannot stop a funded attack...