What do you mean? You have to accept a friend request before someone can message you. It's more spam-resistant than email, not less. That said, I don't know if there's anything that prevents spamming friend requests.
And how am I going to find the valid friend requests under the hundreds of spam ones? I used it just like a chat version of public email, for bug reports and such, so I don't know who is going to message me beforehand.
Fair enough. I've only ever used XMPP when Google chat used it and at work in the days before Slack.
You can mediate friends requests by having servers generate an invite link, you can generate QR codes your friend can scan on a side channel, ... There are ways
Or you can just show the welcome message from a new contact, just like anyone else does. Adding a 2nd factor here is the reason XMPP suck.