File uploader / picture uploader can be use for spam attack

It is, and it does. This is known / intended behavior. The onus is on the Bubble developer to prevent “orphaned” (uploaded to Bubble AWS storage but not referenced in the DB) files.

Also, if you’re dealing with lots of images, you might want to check out Upload Buddy, as it allows (among other things) for images to be resized before uploading, which results in a smooth user experience but also helps to conserve Bubble storage. (Of course, non-image files can be uploaded as well.)