The user wouldn't have to pay anything to create an account, just to vote. Sure, spammers can farm large amounts of reputation through botnets, but that's really expensive: you're putting a cost on it. The returns are already not so high for disseminating this kind of spam.

Having no reputation wouldn't mean you can't do anything -- just that what you do is less trusted and has lower priority.