That's a self-imposed problem. If they used a semi-random account handle (e.g. chosen nickname + 4 digits) there would be nothing to enumerate, and remaining spam could be filtered out with a "message requests" feature.

I've received hundreds of spam messages on Facebook, but I only found out about them years later when I clicked on "message request" tab by accident, it's extremely effective.

That problem would be mostly solved if they didn’t use the phone number = account model. If you have public usernames that are sufficiently complex, spammers would spend the vast majority of their time shouting into the void. Presumably, seeing an account spamming messages to recipients that don’t exist would be a strong indicator of an account that should be closed.