If they guessed the verification code then there's clearly a massive code issue.
And if a report system is broken enough you can just not have one. Or maybe take away the ability of an account to send friend requests while leaving the rest of it intact. That would take care of spambots without ruining real accounts.
And if a report system is broken enough you can just not have one. Or maybe take away the ability of an account to send friend requests while leaving the rest of it intact. That would take care of spambots without ruining real accounts.