This assumes they could only access DMs of people that sent out the spam (which includes Biden). In reality they could have pulled Trump and friends' DMs also, who have a history of using twitter for official use and seem to have questionable operational security.