There isnt really any way to 'fix' this issue that is everywhere on every platform, not one that doesnt do more harm than good anyway.

To turn off chat for everyone cept friends might be an option but not one I think should be taken just because of this, because this also in effect hinder legit ppl who might want to reach out and ask or inform something, maybe about something u wrote on forum, a review etc, without wanting to be friends or using profile.
Why punish the many over the few? Ive never been a fan of this approach in anything.

GOG could do a sticky which is alr done even tho it shouldnt have to be done in the first place because think ppl <3 :p
And otherwise lets all make it known not to trust these messages, the same way we wouldnt trust fake emails and dont accept onlyfans friend requests on x etc (or do u? :P ).

There will always be trolls and bot generated content, and its up to ourselves to inform and use good judgement when online.
The only real 'fix' that many seem to strive for everywhere now to greatly limit or stop fake engagements and toxic behaviour, would be forced signup with real ID etc once the internet and all isp's are under full control and vpns banned.
This is in no way anything anyone should want and it will do far more harm than good and definitly exclude a lot of real humans for one reason or another.
Its also a thought that all these massive amounts of fake accounts, trolls etc, are all done deliberatly and left to roam free and cause destruction, to promote and accelerate the use of real ID, vac passports, chips etc etc you name it.
Cause the problem, get the reaction, provide the solution.
Its likely many of these are created and run by whatever powers that be that want this kind of control and order in the first place, let it roam wild and annoy the heck out of us all to the point where we will accept whatever they throw at us to make it stop. Easily done by allowing the markets to flood with all things fake and scams, than when at its peak performance offer us the carrot that is no internet access without real ID = 'no more fake accounts and phishing trolls'.

Its ur choice if u want to block messages, if it gives u peace of mind do it.
Just keep in mind its only a few bad seeds in a forest full of beautiful creatures.

Just a few totally not paranoid ramblings about this subject that actually makes perfect sense in the world we live in. /hide

Alternatively, just assume that any unknown user who PMs you from out of the blue is a potential scammer, spammer or troll unless you are given reason to believe otherwise from someone else you do know and trust. Particularly when there's something at stake -- money, goods/services (which would include a GOG account), personal data, whatever.
And obviously (I should hope), this does not just apply to GOG and its official Discord server.

This is actually pretty nice. And didn't take an awful lot of time to put up too.

While this action will surely negate attempts to exploit potential victims via private messaging, this also prevents non-friended, rule-abiding community members from discreetly contacting you (for whichever legitimate reason).

An observation: following the creation of your dedicated topic, each of the GOG profiles for the accounts owned by you and the other affected users (whom I had noticed publicly acknowledging this, anyway) had been enabled. This (at the very least) reveals the number of possessed games, with certain users even voluntarily revealing individual high-value titles (this alone is likely to be quite enticing for a deceiver seeking to eventually sell accounts containing desirable games).

For those wishing to disclose details of this nature, deactivating the user profile might be seen as a 'non-option'. However, if said customers would likewise prefer to allow all others to directly communicate with them (outside of threads), in the absence of GOG setting a reasonable purchase threshold (as, according to some, they have already done for the forum), and/or a minimum age of a given account, as a prerequisite for the enablement of one-on-one correspondence, this sort of issue may be difficult to resolve (and would-be scammers of the future may continue selectively pursuing such 'prime' targets).

Given there was a huge scandal involving security breaches at DISCORD a little over a year ago, anybody thinking their private infor is safe at Discord is nieve to the point of being stupid.

The main problem is that businesses, governments and even banks increasingly mandate the use of these shady channels (oh, look, it's so much eco-friendly and convenient, so we're on moral high ground! (because making, running and disposing of computers is traditionally more eco-friendly than paper...)), and don't even bother to provide even a minimum of authenticitity verification to you ("you know this mail is legitimate because we address you by your full name" is no verification, not even an assurance. But they pretend that your name and email combo totally has never been stolen or leaked, suuure... let alone if your mail address is "firstname.lastname@somewhere.whatever", completely impossible to guess such secrets from that...). Support contact only via Discord isn't completely unheared of, there are businesses that exclusively require a fakebook account for support. Emails are the new (sub)standard communication practice, even banks (ab)use it. Noone provides a GPG signature that would enable the recipient to verify the identity of the sender and the correctness of the content, even though it's finally native in Thunderbird.
Signup via ID only and similar schemes (looking at you, EU age verification!) is just harming the honest user, who instantly becomes victim to all sorts of state and corporate abuse, while the real criminals get away rich and unpunished because they operate from countries that at best don't give a crap and at worst (read: commonly) are in league with them.

All of this cannot be coincidence, it is unfathomable that even after over two decades of rising fraud and spam anyone would actually still believe that providing communication by email and internet platforms, especially third-party ones, is safe, secure and confidential. It's either that they purposefully make us vulnerable, or our governments, banks and corporations are truly led by the most incompetent, stubborn, self-righteous and reality-blind people in existence. Both are equally frightening to be honest, and both deserve the utmost distrust we can muster.

Since the Hack late last year I quit discord i started getting spam calls over my Mobile, I Completely quit all main social Media and Move To the Matrix Network Under Element, its still taking some getting used to but wow is it just next level, everything is secured at User level.