I have friend/group invites on friends of friends, and comments set to friends only. That's all for the contact section.
This seems a bit of a loophole in the privacy settings...
See, I can't even add them to Messenger and then block them without having to send them an invite first.
Edit: the web version of Messenger seems a bit better...
Have reported abuse and reported as a spammer. Although I doubt much will happen (at least, any time soon)...