At my instance I did setup a email wildcard (receive emails from any address on that domain which don't already have a account) and I get a lot of phishing and scam emails, most of them are send "to" /c/[email protected], as link to this community is linked in sidebar, but I also seen emails "send to" random usernames
So yeah, It is happening, i wonder how bad it is on larger instances
If you only need a bare minimum, and don't plan to heavily use CI/CD, container/packages registries, integrations with other tools i would go with gitea/forgejo (you can always use external tools on top), else i would use selfhosted Gitlab, it has pretty much all the things you could imagine to need with software development and deployment