That's a self-imposed problem. If they used a semi-random account handle (e.g. chosen nickname + 4 digits) there would be nothing to enumerate, and remaining spam could be filtered out with a "message requests" feature.

I've received hundreds of spam messages on Facebook, but I only found out about them years later when I clicked on "message request" tab by accident, it's extremely effective.