So what exactly will basset do? Delete tickets? PR? Comments? Users? Projects?
All of these? :)

I'd say all of the above.

You might want to have it just hide stuff and only delete after a human has checked things. False positives will be very costly otherwise.

Given the intensity of the spammers, I'd say that's not maintainable.
If need be, we should have all info in Basset and can restore it manually.

We now support instance-wide group admins, does that solve this ticket?

If those instance-wide group admins can have API tokens that grant them admin everywhere, then yes. That'll work just fine.

They can have API tokens just like anyone else and these tokens will make them recognized as admin everywhere.

There maybe some ACLs that aren't (yet) project-less but let's see this when we need it :)

Alright, let's close this one as fixed then, thanks! :)