The function llInstantMessage can be used to send spam to users as noted here https://feedback.secondlife.com/feature-requests/p/unblockable-instant-message-spam and here https://feedback.secondlife.com/scripting-features/p/feature-request-llinstantmessagenoemail-same-function-as-llinstantmessage-but-do

While there are legitimate uses for this function, it is being abused by some to send spam. For example, I get IM via email as a convenience but that also means I get these spam messages too. In particular, region owners are using this message to send IMs only to people who are not logged in making it difficult to put an end to.

My suggestion is before this function can be used to send a message to anyone other than the owner of the sending object, the calling object MUST get permission from the recipient first.