Does this mean that someone could take down all of github by sending (fraudulent) DMCA takedown notices for every single repo (from some fake return address)?
And then it would then be incumbent on the users to fight that?
No. The main requirement for a DMCA request to be valid is that it come from a real entity. If you sent them with a fake return address they wouldn't be valid DMCA requests anymore.
That said, yes the DMCA can be abused. The check against that is the same check that exists against other kinds of fraud: it's illegal.
And then it would then be incumbent on the users to fight that?