There is a need to require opt-in without any custom message to a group or something before allowing invites. Our organization recieves at least one of these a day. It is an absolute abuse of the platform and needs 20 minutes of design thought to prevent fraud, phishing, and scams. They are right - the software distributed is likely not malware (virus, worm, or otherwise) but it is scams, phishing, etc.