They also do all of the first steps just to get past any spam/scam prevention measures you may have set up. Making initial legitimate posts helps the spammer get past things like user promotions intended to stop scammers from posting garbage right off the bat. I personally have my websites set up with promotions to stop scammers from being able to immediately post spam by forcing x number of valid and approved posts before allowing any urls or use of the private messaging system.