I think you can block a user easily if your server supports XEP-0191, or if it implements some sort of blacklisting. I am unsure about blocking client side, since I never needed it (yet?).

It is probably due to XMPP's lack of popularity, but FWIW I have been using my XMPP for about 4 years and have not received a single unsolicited message yet.