I don't see how it could be gamed
I could see people testing the waters by trying out various kinds of spam link networks and thinking they can just disavow the links if they get penalized.
One of the problems with "Neanderthal spam" is that once someone starts that ball rolling, they can't stop it or reverse it. A disavow links tool might be abused in this way, unless a preventative algorithm was already in place at launch time.
Otherwise, in addition to helping innocently punished websites, the tool might attract MORE people into trying the spam route.
--------------------
In recent years, I've seen many penalized sites who proclaimed they never bought links or participated in link rings, etc. Yet when I checked their backlinks, the paid link pattern often jumped out at me and I confronted them with it.
Sometimes they sheepishly admitted what they had done. Other times they located an employee who had actually done the deed - even in very large corporate environments. And sometimes (much more rarely) they seemed to have actually been the victim of a negative SEO campaign.
-------------
Another common reason for spammy backlinks is that your server has been hacked. Today many hacks are cloaked so that only googlebot sees the parasite links that were injected - links that your site IS ACTUALLY HOSTING without your knowledge.
The hacker who placed that parasite content then starts to throw link juice at those pages, in order to power up the hidden links that are in place.
So if you find spammy backlinks, especially ponting to internal URLs, check to see if you were hacked. You can switch to a googlebot user agent, but that's not going to be good enough to resolve every case. The sure-fire test ios Google's Fetch as googlebot tool - because not only the user agent but also the IP address will be correct. Then even the best cloaked parasite content will show itslef if its there.
I would say be ruthless about your business actually having created or accepted those backlinks links, possibly through an employee, a contractor, or some third party. Most online niches are not competitive enough for negative SEO to be commonplace. If your site is in such a cutthroat market, you probably already know that ;)
However, the hacked server/parasite hosting scenario, may be put in place to benefit a site in one of the cutthroat markets. Parasite hosting is actually illegal, and not just a competitive tactic. These people aren't fooling around - they are criminal.
----------
I agree that Penguin is looking at a lot more than backlinks. However, safeguarding yourself against bad backlinks is an important step.