Facebook has a privacy setting that allows you to dictate who can send you requests. It defaults to letting everyone, even bots, send you a request.