Google used to implement this, DDG still implements this, most small->medium XMPP servers still implement this. For a while, Facebook was the odd one out for not supporting it.

Spam was less of a problem than e.g. spam on AIM. There's the fact that it's not any harder to sign up for AIM than a XMPP network, it's not popular enough and the audience too tech-savvy for spammers to bother, and if a specific host was a bad apple it's easy to BL them.