how would you protect a URL redirection service from spam?
evgen: If you don't take a peek at the content on the other side of the URL then your options are somewhat limited.  If I were faced with this problem I would probably start by doing broad "spam site" classification based on the domain name (which would probably eventually involve things like doing DNS/whois lookups and weighting by registrar.)  Once you have likely targets you can silently blackhole the known spam sites and maybe create a "this might be spam, press the button to continue at your own risk" landing page for sites in the classification grey zone.