And how am I going to find the valid friend requests under the hundreds of spam ones? I used it just like a chat version of public email, for bug reports and such, so I don't know who is going to message me beforehand.
You can mediate friends requests by having servers generate an invite link, you can generate QR codes your friend can scan on a side channel, ... There are ways
Or you can just show the welcome message from a new contact, just like anyone else does. Adding a 2nd factor here is the reason XMPP suck.
Fair enough. I've only ever used XMPP when Google chat used it and at work in the days before Slack.