This is not even an exploit btw, it's just how the game works. To send an invitation to someone, you only need the EpicID or the SteamID, there is no check done by the game to verify that he is in your friend list
I don't understand how someone can spam all three of us with invitations when we didn't even added him?