Okay I have used this feature before and I do not believe it will demote people but I usually set up a group that promotes from the default user group.
Because I planned this from the start.
Say they are in the user group.
You create a group that allows more permissions and set it to 100 posts.
Well the existing users with over 100 posts do not get promoted till they post one more time.
Or you add them manually to the new group.
The comparison to promote only happens when they post.
For your scenario ,if you make it like 5 or so posts a person can just post 5 spam posts and get promoted.
This happens even if you moderate the posts because it counts total posts not total approved posts.
So when a member posts it just says if total posts are > than set post level add member to group.
Now there have been a few newer releases since I observed this but I do not recall if this was addressed in the change logs..
This has been reported before
HERE.